This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

radiotap.mactime field with Atheros chipset

0

Hi everybody I try to get the radiotap.mactime field from WiFi dongle with Atheros chipset. With any Atheros based device, I get an empty field, while I get the correct value with a Broadcam chipset. I'm on Linux (Ubuntu 12.4) and I tried all what I could to get this data available to tshark (drivers and firmware are up to date)

Any hints from you guys on this ?

BR

Olivier.

asked 08 Aug '13, 06:59

omarce's gravatar image

omarce
11112
accept rate: 0%

I get an empty field

Empty in what sense? Not present at all, or present but with a bogus value (e.g., always zero)?

(08 Aug '13, 15:24) Guy Harris ♦♦

One Answer:

0

Hi Guy, the field no present at all. Meanwhile, I found the reason. When looking at radiotap.tsft.present it returns false, so it was normal that mactime was empty.

The reason was that I used a USB device with an old Atheros chipset, and the associated driver was carl9170 and not ath9k_htc. carl9170 seems not able to reporting mactime.

I was confused by the fact that I had several dongle, then several drivers loaded.

BTW I think that it would be better for tshark to return an non empty char string (like "none") rather than an empty string.

Regards

answered 09 Aug '13, 01:30

omarce's gravatar image

omarce
11112
accept rate: 0%

I think that it would be better for tshark to return an non empty char string (like "none") rather than an empty string

File a bug on that if you want it changed, but be prepared for other users to say they prefer nothing to be reported for absent fields.

(09 Aug '13, 12:14) Guy Harris ♦♦

Hi Olivier,

Cna you please share both the wireless adapters (Broadcom and Atheros) used that eventually reported the radiotap.mactime ?

I am facing similar problem when I try with Dlink DWA-160-RevA2 card that AR9170.

Thanks, Sudheer

(08 Jan '14, 11:57) Sudheer