On the "Infrastructure BSS" diagram in Figure 2-4, there is a dotted
line indicating a wireless connection between the two notebooks at the
bottom. While this would be accurate for a Independent BSS (ad-hoc BSS), it is
inacurate for the Infrastructure BSS, where all traffic
must pass first to the Access point (AP).

The subtype name for subtype value 0111 in Table 3-1 should be CF-Ack+CF-Poll rather
than Data+CF-Ack+CF-Poll.

The Length field of the Supported Rates Information Element is labeled as 2 octets.
Like all other IEs it should only be one.
(fig 4-32)

I had several problems understanding this diagram at first.

The "7" over the Data Rate Label, really should be "0-7" as this is a variable length
field (only the data rates supported would be here).

And the zoom out is an example of two elements, inspite of the label which is
singular. You have to read the text to figure this out.

Also the Mandatory field is shown on the right, whereas the example codes it on the
left. The ordering probably doesn't matter, but the flipping causes some confusion.
Suggestion: Put the "Mandatory" rate field first, and the optionals last on the
frame. BTW: they are all rate labels.

And the positioning of the "Least <-> Most significant" label is also misleading.
The rates labels don't appear to have any order, and I'm guessing this is really
intended to talk about the label bit encoding, but it's on top of the label bytes.
It should be moved down to the expanded field view.

in the WEP key lengh sidebar talking about the 128-bit WEP, Gast says, "After
subtracting 104 bits for the shared secret component of the RC4 key, only 104 bits
are secret", when he means something like "after subtracting the 24 bit
Initialization Vector component of the RC4 key, only 104 bits are secret."

On figure 4-50 the bits of RSN Capabilities point to Authentication suite bytes.

The third paragraph says that "In [figure 10-1], the hopping pattern is {2,8,4,7}".
The figure shows {2,8,4,6}.

Figure 10-15 shows the first side lobe extending 11Mhz out from the center frequency.
This is correct I believe.

Figure 10-16 shows the first side lobe extending out what appears to be about 5Mhz.
If it were 11Mhz then it would extend to almost the halfway point between Channels 1
and 6. The scale of the lobe pattern appears to be skewed.

In the paragraph titled "Header" it says: "Five fields comprise the header:....".
It's wrong. It says twice the same field (Signal) so it should say "Four fields..."
and cite the Signal field only once.

A more elegant way to HUP a process is:

kill -1 `ps ax | grep "[c]ardmgr" | awk '{print $1}'`

You remove the u flag in ps aux since you don't care about the user running the
process. grep "[c]ardmgr" avoids having to use grep -v grep. We put the double quotes
in grep's argument to pass through the shell. Awk prints $1 since ps doesn't print
the user anymore.

The paragraph beginning "Closed Wireless System" implies that Lucent APs are able to
drop any traffic from non-Orinoco cards. Strictly speaking, that is incorrect. At
the time the text was written, Orinoco was the only vendor that implemented the
feature, so by definition, it resulted in dropping all traffic from other vendors'
equipment. That is no longer the case. Many other vendors have duplicated the
feature, and it is now widely available on many products.

Discussion of this feature needs substantial expansion. In addition to expanding
this paragraph, the book should also include a discussion of SSID broadcasts in the
security chapter and deployment chapter, and note that many analysis tools now flag
SSID broadcasts as a potential security vulnerability.

Ethereal now supports Lucent Orinoco under Linux, making
the statement "For data capture on Linux, only Intersil-based cards are supported."

See
http://www.ethereal.com/faq.html#q4.21