To my understanding a probe request is a management frame.
Yes.
But within pcap_next()
what struct do I need to pass in?
To quote the pcap_next man page:
const u_char *pcap_next(pcap_t *p, struct pcap_pkthdr *h);
...
pcap_next() returns a pointer to the packet data on success, and
returns NULL if an error occured, or if no packets were read from
a live capture (if, for example, they were discarded because they
didn't pass the packet filter, or if, on platforms that support a
read timeout that starts before any packets arrive, the timeout
expires before any packets arrive, or if the file descriptor for
the capture device is in non-blocking mode and no packets were
available to be read), or if no more packets are available in a
``savefile.'' Unfortunately, there is no way to determine whether
an error occured or not.
So what you need to pass in is:
- a pointer to a
pcap_t
, which you've gotten by using pcap_create()
, pcap_set_rfmon()
to arrange that you will be capturing in monitor mode, and pcap_activate()
;
- a pointer to a
struct pcap_pkthdr
- that structure type is declared in pcap.h
, so you'll want to do something such as struct pcap_pkthdr hdr;
and pass &hdr
as the second argument;
and you will receive, as the return value, either NULL on an error (or a timeout, so do not treat NULL as an indication that something failed; you really want to use pcap_next_ex()
here) or a pointer to a buffer containing the raw packet data.
After pcap_activate()
returns, if it succeeds, you will need to call pcap_datalink()
on the pcap_t *
to see what format the raw packet data has. If it's equal to DLT_IEEE802_11_RADIO
, then the raw packet data begins with a radiotap header, and there's an 802.11 header following the radiotap header.
My question is though, where are the standard headers defined?
The 802.11 headers are defined in IEEE Std 802.11-2012. Whether your OS happens to have a C header for those headers and, if it does, where the headers are, depends on the OS. You might not have any such header.
You really might want to consider just grabbing the tcpdump source and hacking it to do what you need, rather than reinventing all the parsing it does.