Monitor mode on if_wi

[Oliver Enzmann]

The latest if_wi from Mon Jul 21 is supposed to enable 
monitor mode on Prism based cards. I've had partial
success in getting monitor mode to work:

Linksys WCP11 card (Intersil Prism 2.5 chipset, flashed
with Intersil firmware Primary 1.1.1, Station 1.7.4). 
The FreeBSD on this box is a very recent -CURRENT (all
recent changes to the wi driver).

dstumbler v0.3 seems to work just fine:

   ifconfig wi0 monitor up
   /opt/bin/dstumbler wi0 -o

I see two access points, as expected.

Also, prism2dump does just fine: 

   /opt/bin/prism2ctl wi0 -m
   /opt/bin/prism2dump wi0

I see beacons as well as user data.

However, tcpdump on wi0 while in monitor mode gives 
bogus results. No 802.11 headers are shown at all
and the packet dump seems all wrong.

Also, recovering WEP keys using dwepdump /dwepcrack 
fails despite huge amounts of gathered data. While
looking at the pcap files created by dwepdump with 
tcpdump -r , I see bogus packets, again without any 
IEEE 802.11 headers at all. 
 
Kismet is another story. It discovers hundreds of
access points (while there are only two within reach).
The pcap files contain the 802.11 headers but the 
MAC addresses of the sending stations seem to vary
at random. 

Any ideas?

--Oliver