This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Viewing RSSI value in Wireshark

0

In Wireshark Version 1.8.2, I tried Edit -> Preferences... -> Columns -> Press "Add" button -> As "Field type" I choose "IEEE 802.11 RSSI" and finally I choose name "RSSI" and click on "Apply" button. The column appeared but there are no values in the column.

After reading (http://ask.wireshark.org/questions/14963/how-to-get-the-field-did-unknown-4041-into-the-column), I compiled Wireshark Version 1.8.5 from source but still no values are appearing.

The data was previously collected using pcap and I'm now opening it in Wireshark, how can I view the RSSI values ?

asked 11 Feb '13, 06:11

heidi-ann's gravatar image

heidi-ann
1111
accept rate: 0%

I've now tried compiling wireshark-1.9.0-SVN-47630.tar.bz2 from http://www.wireshark.org/download/automated/src/ but that failed so now I'm trying wireshark-1.9.0-SVN-47626.tar.bz2

(11 Feb '13, 07:33) heidi-ann

I've compiled wireshark-1.9.0-SVN-47626.tar.bz2 from source and there are still no RSSI values

(12 Feb '13, 03:31) heidi-ann

Nobody here suggested compiling newer versions, because no matter WHAT version you compile, if you captured on an adapter the driver for which supplies radiotap, you will not get RSSI values, as those drivers do not something called "RSSI". They supply signal strength indicators in decibels; see my answer to your question. For PPI or AVS headers, they might provide RSSI values, or they might not.

(12 Feb '13, 11:04) Guy Harris ♦♦

2 Answers:

0

You're assuming the values are there to view.

Note, first of all, that IEEE Std 802.11-2012 uses "RSSI" in at least two different senses:

  • Section 14.3.3.3 "RXVECTOR RSSI" clause says "The RSSI is an optional parameter that has a value of 0 to RSSI Max. This parameter is a measure by the PHY of the energy observed at the antenna used to receive the current PPDU. RSSI shall be measured between the beginning of the SFD and the end of the PLCP HEC. RSSI is intended to be used in a relative manner. Absolute accuracy of the RSSI reading is not specified."
  • Table 6-7—ESS "Link Parameter Set" talks about "DataFrameRSSI" and "BeaconRSSI" , and says they are "The received signal strength in dBm of received {Data,Beacon} frames from the network."

There is no field in the set of defined radiotap fields that corresponds to the first of those two meanings; there are only fields that correspond to the signal strength as dB from an arbitrary point (useful only for comparing with other dB values on the same interface, as the arbitrary point may be different for different adapters but will be the same for all packets from the same adapter), and as dB relative to 1 milliwatt. The latter is the second of those two meanings.

If your pcap has radiotap headers, then, with current versions of Wireshark, those values will be shown in the RSSI column, followed by "dB" or "dBm". Most *BSD and Linux drivers use radiotap, so, if you're capturing on FreeBSD, NetBSD, DragonFly BSD, or Linux, those are the values you will get. OpenBSD is using their own incompatible version of radiotap, which uses a defined value for another field for RSSI. I don't know whether Wireshark supports that. OS X drivers also use radiotap as one form of radio data.

If your pcap has PPI headers, which are supported by AirPcap devices on Windows and with at least some drivers on some versions of OS X, those also only supply the RSSI as dBm.

If your pcap has AVS headers, they might provide either "raw" RSSI values in the sense of the first definition, "normalized" versions of those values scaled to a range of 0-1000, or dBm values. Those will also be displayed in the RSSI column.

If your pcap has Prism headers, they might also provide an RSSI value.

All of those header formats allow a driver not to supply signal strength values, so the adapter or its driver might not be supplying them, in which case you can't see them in the capture.

In addition, on Linux and OS X, you won't get any radio information unless the capture was done in monitor mode.

So, unless the packet details show a radiotap, AVS, PPI, or Prism header, and that header includes an signal strength value, your pcap doesn't have any signal strength information in it to show, and there's nothing that Wireshark can do to show it.

If your reference to this question means that you have Prism headers in your pcap (that's what the question is about), then note that no driver I saw for Linux that supplies Prism headers supplies any sort of signal strength indicator; in that case, you may have a network adapter that doesn't supply signal strength values to the host, or a driver for that adapter that doesn't supply those values in captured packets.

What hardware were you doing this capture on, and what software was it running (if it's a Linux distribution, say which one)?

answered 11 Feb '13, 18:39

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%

edited 15 Feb '13, 11:48

0

I tried Edit -> Preferences... -> Columns -> Press "Add" button -> As "Field type" I choose "IEEE 802.11 RSSI" and finally I choose name "RSSI" and click on "Apply" button. The column appeared but there are no values in the column.

As @Guy Harris said, maybe there are no RSSI values in your capture file.

Please try the following capture file: http://wiki.wireshark.org/SampleCaptures?action=AttachFile&do=get&target=Http.cap

Now you should see RSSI values in the column (I do see the values with Wireshark 1.8.4 on Windows XP). If you still don't see those values on your system, please report back.

BTW: Do you see a PPI header (next to the frame header) in your capture file?

Regards
Kurt

answered 12 Feb '13, 04:21

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 12 Feb '13, 04:22

Note that PPI headers are not guaranteed to contain an "RSSI" value, in the sense of a value described in the specification as "RSSI", or in the sense of "a value between 0 and RSSI_Max" - they contain dBm values, but not raw RSSI values, in captures on my MacBook Pro.

(12 Feb '13, 12:11) Guy Harris ♦♦

Well, that's another problem ;-)

(12 Feb '13, 12:14) Kurt Knochner ♦