Hello, I have the attached photos for a capture for Wifi Frames in Wireshark.
When I was analyzing the frame format for different packets, I found that when I move from the MCS Information field to the A-MPDU status field, three bytes are being escaped by Wireshark. So I checked the Radio Tap header format, and I found nothing is mentioned about these three bytes. So could you please clarify why three bytes are ignored by the parser. Additionally according to the A-MPDU Status field definition in the following Site, the structure should be aligned by 4 bytes. So the subfields should be multiple of 4 bytes i.e. The A-MPDU Status should be 16 Bytes long, correct? Notes:
asked 12 Jun '15, 11:37  Hany Assasa |
One Answer:
This is because the A-MPDU Status field requires a 4 bytes alignment, meaning that the structure must start at a multiple of 4 bytes. The 3 bytes set to 0 are padding between the end of the MCS field and the beginning of the A-MPDU Status field. You can read the "Alignment in Radiotap" paragraph on http://www.radiotap.org/ for more details. answered 12 Jun '15, 12:01  Pascal Quantin edited 12 Jun '15, 12:07 |
