From: Gunjan Mehta [mailto:gunjanmehta08@gmail.com] Sent: Friday, August 28, 2015 10:51 AM To: Jeff Haran Cc: kernelnewbies Subject: Re: Identify Beacon Frame Then how do i capture the beacon frames? On Fri, Aug 28, 2015 at 10:40 PM, Jeff Haran <Jeff.Haran@citrix.com<mailto:Jeff.Haran@citrix.com>> wrote: I don’t know. Pcap maybe. Jeff Haran From: kernelnewbies-bounces@kernelnewbies.org<mailto:kernelnewbies-bounces@kernelnewbies.org> [mailto:kernelnewbies-bounces@kernelnewbies.org<mailto:kernelnewbies-bounces@kernelnewbies.org>] On Behalf Of Gunjan Mehta Sent: Friday, August 28, 2015 9:21 AM To: kernelnewbies; netfilter-devel@vger.kernel.org<mailto:netfilter-devel@vger.kernel.org> Subject: Identify Beacon Frame Hi All, I am new to kernel development. I am writing a kernel module that captures packet at the netfilter pre - routing hook. I only want to capture the BEACON FRAME. I have few queries: 1>When the beacon frame comes to receiving machine do the sk_buff gets allocated? 2> How can i identify the beacon frame at the pre routing hook? 3> Beacon frame consist of a string for authentication of client with the server, can i use sk_buff pointers to get access to that string, if sk_buff is allocated? Regards Gunjan These beacon frames do not appear to be IP packets. If that is true, I don’t think you are going to see them in any netfilter hooks. Jeff Haran