diff -crpN rt2500-1.1.0-b3/Module/rtmp_data.c rt2500-1.1.0-b3.patched/Module/rtmp_data.c
*** rt2500-1.1.0-b3/Module/rtmp_data.c	2005-07-30 18:28:20.000000000 +0200
--- rt2500-1.1.0-b3.patched/Module/rtmp_data.c	2005-09-10 00:21:40.000000000 +0200
*************** NDIS_STATUS	RTMPHardEncrypt(
*** 2754,2759 ****
--- 2754,2822 ----
  	}
  	AsicForceWakeup(pAdapter);
  	
+ 	if (pAdapter->PortCfg.BssType == BSS_MONITOR)  // Send raw packets
+ 	{
+ 		// Get the Tx Ring descriptor & Dma Buffer address
+ #ifndef BIG_ENDIAN
+ 		pDest = (PUCHAR) pAdapter->TxRing[pAdapter->CurEncryptIndex].va_data_addr;
+ 		pTxD  = (PTXD_STRUC) pAdapter->TxRing[pAdapter->CurEncryptIndex].va_addr;
+ #else
+ 		pDest = (PUCHAR) pAdapter->TxRing[pAdapter->CurEncryptIndex].va_data_addr;
+ 		pOriginDest = pDest;
+ 		pDestTxD  = (PTXD_STRUC) pAdapter->TxRing[pAdapter->CurEncryptIndex].va_addr;
+ 		TxD = *pDestTxD;
+ 		pTxD = &TxD;
+ 		RTMPDescriptorEndianChange((PUCHAR)pTxD, TYPE_TXD);
+ #endif
+ 
+ 		if ((pTxD->Owner == DESC_OWN_NIC) || (pTxD->CipherOwn == DESC_OWN_NIC))
+ 		{
+ 			// Descriptor owned by NIC. No descriptor avaliable
+ 			// This should not happen since caller guaranteed.
+ 			// Make sure to release Tx ring resource
+ 			pAdapter->RalinkCounters.TxRingErrCount++;
+ 			spin_unlock_irqrestore(&pAdapter->TxRingLock, irqflag);
+ 			return (NDIS_STATUS_RESOURCES);
+ 		}
+ 
+ 		if (pTxD->Valid == TRUE)
+ 		{
+ 			// Ndis packet of last round did not cleared.
+ 			// This should not happen since caller guaranteed.
+ 			// Make sure to release Tx ring resource
+ 			pTxD->Valid = FALSE;
+ 
+ #ifdef BIG_ENDIAN
+ 			RTMPDescriptorEndianChange((PUCHAR)pTxD, TYPE_TXD);
+ 			*pDestTxD = TxD;
+ #endif
+ 
+ 			pAdapter->RalinkCounters.TxRingErrCount++;
+ 			spin_unlock_irqrestore(&pAdapter->TxRingLock, irqflag);
+ 			return (NDIS_STATUS_RESOURCES);
+ 		}
+ 
+ 		memcpy(pDest, skb->data, skb->len);
+ 
+ #ifdef BIG_ENDIAN
+ 		RTMPFrameEndianChange(pAdapter, pOriginDest, DIR_WRITE, FALSE);
+ 		RTMPDescriptorEndianChange((PUCHAR)pTxD, TYPE_TXD);
+ 		*pDestTxD = TxD;
+ 		pTxD = pDestTxD;
+ #endif
+ 
+ 		RTMPWriteTxDescriptor(pTxD, TRUE, CIPHER_NONE, TRUE, FALSE, FALSE, RetryMode, FrameGap,
+ 		pAdapter->PortCfg.TxRate, 4, skb->len, pAdapter->PortCfg.TxPreambleInUsed, AccessCategory);
+ 
+ 		// Increase & maintain Tx Ring Index
+ 		pAdapter->CurEncryptIndex++;
+ 		if (pAdapter->CurEncryptIndex >= TX_RING_SIZE)
+ 			pAdapter->CurEncryptIndex = 0;
+ 
+ 		pAdapter->RalinkCounters.EncryptCount++;
+ 	}
+ 	else  // Usual process
+ 	{
  	// Sequence Number is identical for all fragments belonged to the same frame
  	// Sequence is 0 - 4095
  	pAdapter->Sequence = ((pAdapter->Sequence) + 1) & (MAX_SEQ_NUMBER);
*************** NDIS_STATUS	RTMPHardEncrypt(
*** 3410,3415 ****
--- 3473,3479 ----
  		pAdapter->RalinkCounters.EncryptCount++;
  		
  	}	while (NumberRequired > 0);
+ 	}  // End of usual process
  
  	
  	// Kick Encrypt Control Register at the end of all ring buffer preparation
diff -crpN rt2500-1.1.0-b3/Module/rtmp_info.c rt2500-1.1.0-b3.patched/Module/rtmp_info.c
*** rt2500-1.1.0-b3/Module/rtmp_info.c	2005-07-30 18:28:20.000000000 +0200
--- rt2500-1.1.0-b3.patched/Module/rtmp_info.c	2005-09-10 00:36:43.000000000 +0200
*************** INT RT2500_ioctl(
*** 1963,1969 ****
                  if (pAdapter->PortCfg.BssType == BSS_MONITOR)
                  {
                      pAdapter->net_dev->type = 801;
!                     RTMP_IO_WRITE32(pAdapter, RXCSR0, 0x4e);
                  }
                  else
                  {
--- 1963,1974 ----
                  if (pAdapter->PortCfg.BssType == BSS_MONITOR)
                  {
                      pAdapter->net_dev->type = 801;
!                     RTMP_IO_WRITE32(pAdapter, RXCSR0, 0x46);
!                 }
!                 else if (pAdapter->bAcceptPromiscuous == TRUE)
!                 {
!                     pAdapter->net_dev->type = 1;
!                     RTMP_IO_WRITE32(pAdapter, RXCSR0, 0x6e);
                  }
                  else
                  {
diff -crpN rt2500-1.1.0-b3/Module/rtmp_init.c rt2500-1.1.0-b3.patched/Module/rtmp_init.c
*** rt2500-1.1.0-b3/Module/rtmp_init.c	2005-07-30 18:28:20.000000000 +0200
--- rt2500-1.1.0-b3.patched/Module/rtmp_init.c	2005-09-10 00:31:56.000000000 +0200
*************** void    NICInitializeAsic(IN    PRTMP_AD
*** 1004,1010 ****
      }
  
      // Kick Rx
!     if (pAdapter->bAcceptPromiscuous == TRUE)
      {
          // Register bits with "drop unicast not to me disabled"
          RTMP_IO_WRITE32(pAdapter, RXCSR0, 0x6e); 
--- 1004,1015 ----
      }
  
      // Kick Rx
!     if (pAdapter->PortCfg.BssType == BSS_MONITOR)
!     {
!         // Register bits to receive everything
!         RTMP_IO_WRITE32(pAdapter, RXCSR0, 0x46);
!     }
!     else if (pAdapter->bAcceptPromiscuous == TRUE)
      {
          // Register bits with "drop unicast not to me disabled"
          RTMP_IO_WRITE32(pAdapter, RXCSR0, 0x6e); 
diff -crpN rt2500-1.1.0-b3/Module/rtmp_main.c rt2500-1.1.0-b3.patched/Module/rtmp_main.c
*** rt2500-1.1.0-b3/Module/rtmp_main.c	2005-07-30 18:28:20.000000000 +0200
--- rt2500-1.1.0-b3.patched/Module/rtmp_main.c	2005-09-10 00:51:40.000000000 +0200
*************** INT RTMPSendPackets(
*** 359,365 ****
  
      DBGPRINT(RT_DEBUG_INFO, "<==== RTMPSendPackets\n");
  
!     if (pAdapter->PortCfg.BssType == BSS_MONITOR)
      {
         dev_kfree_skb_irq(skb); 
         return 0;
--- 359,365 ----
  
      DBGPRINT(RT_DEBUG_INFO, "<==== RTMPSendPackets\n");
  
! /*  if (pAdapter->PortCfg.BssType == BSS_MONITOR)
      {
         dev_kfree_skb_irq(skb); 
         return 0;
*************** INT RTMPSendPackets(
*** 373,379 ****
          // And Mibss for Ad-hoc mode setup
          dev_kfree_skb_irq(skb);
      }
!     else
      {
          // This function has to manage NdisSendComplete return call within its routine
          // NdisSendComplete will acknowledge upper layer in two steps.
--- 373,379 ----
          // And Mibss for Ad-hoc mode setup
          dev_kfree_skb_irq(skb);
      }
!     else  */  // Commented out to send raw packets
      {
          // This function has to manage NdisSendComplete return call within its routine
          // NdisSendComplete will acknowledge upper layer in two steps.
*************** VOID RT2500_set_rx_mode(
*** 705,711 ****
  {
      RTMP_ADAPTER *pAd;
      pAd = net_dev->priv; 
!     if (net_dev->flags&IFF_PROMISC)
      {
          pAd->bAcceptPromiscuous = TRUE;
          RTMP_IO_WRITE32(pAd, RXCSR0, 0x6e);
--- 705,716 ----
  {
      RTMP_ADAPTER *pAd;
      pAd = net_dev->priv; 
!     if (pAd->PortCfg.BssType == BSS_MONITOR)
!     {
!         RTMP_IO_WRITE32(pAd, RXCSR0, 0x46);
!         DBGPRINT(RT_DEBUG_TRACE,"rt2500 acknowledge MONITOR on\n");
!     }
!     else if (net_dev->flags&IFF_PROMISC)
      {
          pAd->bAcceptPromiscuous = TRUE;
          RTMP_IO_WRITE32(pAd, RXCSR0, 0x6e);
*************** VOID RT2500_set_rx_mode(
*** 715,721 ****
      {
          pAd->bAcceptPromiscuous = FALSE;
          RTMP_IO_WRITE32(pAd, RXCSR0, 0x7e);
!         DBGPRINT(RT_DEBUG_TRACE, "rt2500 acknowledge PROMISC off\n");
      }   
  
  }
--- 720,726 ----
      {
          pAd->bAcceptPromiscuous = FALSE;
          RTMP_IO_WRITE32(pAd, RXCSR0, 0x7e);
!         DBGPRINT(RT_DEBUG_TRACE, "rt2500 acknowledge MONITOR/PROMISC off\n");
      }   
  
  }