Reading RxControl in promiscuous mode

[alguresn]

Hi!

I'm working with esp8266 as sniffer to get Source MAC address, rssi and type from every packet received.

I read sniffer introduction document from Espressif library and I could see that exists a structure Sniffer_buf that contains other named RxControl where rssi is stored. However, when I get buf vector from wifi_promiscuous_rx callback, the first data in that vector is the packet, no RxControl, therefore when I cast vector to structure as pulkin do in his project https://github.com/pulkin/esp8266-injection-example and I read sniffer->buf[4] to sniffer->buf[9] the MAC obtained is not address 1 but address 3 and sniffer->buf[10] to sniffer->buf[21] are not MAC addresses. I know that because I compare the packets with obtained through wireshark.

After that, now I know why sniffer->rx_ctrl.rssi values are always 0x80 or 0x08.

The question is: anyone know how this buf vector is organized? or anyone know any SDK (I am working with esp_iot_sdk_v0.9.3) that returns a structure type Sniffer_buf as wifi_promiscuous_rx callback vector?

Thanks in advance for your help.