Raw WiFi Packets with WinPcap

Question

Consider the simple C code to send a single raw packet with WinPcap. The lines related with building the packet header starts with the following comment:

/* Supposing to be on ethernet, set mac destination to 1:1:1:1:1:1 */

Therefore you might guess that, in order to send a Raw WiFi Packet, you should change this block of the code accordingly.

However, this is not the case. You can send a Raw WiFi Packet without changing one single line of that code, just filling the right MAC addresses. The same is true when capturing packets, instead of WiFi headers the packets will have Ethernet headers.

After some searching, it seems that this issue is related with Windows emulating a 'fake ethernet' when passing the packets to WinPcap. Unfortunately I couldn't find much more details about it.

1st Issue
How this 'fake ethernet' works? Is it possible to bypass it or disable it?

2nd Issue
Is it possible to have full control over the WiFi headers? (even if this require something else than WinPcap)

Answer 1

How this 'fake ethernet' works?

Either the network adapter itself supplies packets to the host with fake Ethernet headers (transforming the 802.11 MAC, LLC, and SNAP headers into an Ethernet header and, for some packets, an LLC header possibly followed by a SNAP header), or the driver does so.

This is only done for data frames; management and control frames are not shown when capturing in this mode. The source and destination MAC addresses of the 802.11 header become the source and destination MAC addresses in the Ethernet header; the TA and RA fields are discarded, as are the frame control and other fields in the header. If the frame has a SNAP header with an OUI of all zeroes, meaning "the PID is an Ethernet type", the PID in the SNAP header becomes the value in the type/length field of the Ethernet header; otherwise, the length of the data in the frame, including the LLC header and everything after it (but not including the FCS) becomes the value in the type/length field. Everything after the SNAP header in the first case, and everything after the MAC header in the second case, becomes the Ethernet payload.

Is it possible to bypass it or disable it?

Yes, but you'll have to install special software on your machine.

Some forms of special software have names such as "Fedora" and "Ubuntu". Unfortunately, they might cause problems when trying to run Windows applications on your machine. :-)

Unfortunately, as you're trying to send packets, trying to do this without replacing Windows with Linux isn't as easy as installing Microsoft Network Monitor and capturing traffic with that. Unfortunately, Microsoft's documentation for "Network Monitor Operation Mode" for "Native WiFi" says that, in that mode, "The driver cannot send packets either on its own or through a call to its MiniportSendNetBufferLists function." Perhaps there are ways of connecting to the Wi-Fi driver the same way some of the user-mode boxes in the diagram on this page do, but, to find them, you might have to start at Microsoft's top-level documentation page for Native 802.11 Wireless LAN and work your way down.