I've a Netgear WG511 PCMCIA card with the prism54 module under linux 2.6.24-rc3. This card in monitor mode adds a header at begin of each packet (enabling the header with a 1 in set_prismhdr private ioctl (the default for me)).
This header is recognized by wireshark as "AVS WLAN Monitor Header" (for now, with a length of 64 bytes), but scapy thinks that it is a PrismHeader? with a length of 144 bytes (the default). This breaks the real Dot11 packet over the Header.
Well, I've wrote my own class to handle this header (attached) based on the information found in packect-wlan.c from the wireshark source. I'm not sure on how to handle the size of the header (which is a field of the header), so someone must take a look at my code an probably fix it. Nevertheless, I think that that code is a good start.
On the other hand, I don't know to distinguish between the real PrismHeader? and this one.
Using scapy 1.1.1-3 (from ubuntu hardy)
