This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

VHT Bandwidth representation in wireshark

0

alt text

While analyzing wireless packet capture traces using wireshark, bandwidth was represented as 20 MHz, channel 1/4. On searching about this, I found this means 20 LL(lower lower) and total bandwidth of 20 LL is 80 MHz. The trace was taken on channel 36, so how were lower channels used for channel aggregation to 80 MHz?

I had searched the links mentioned below for the same :

1) https://cs.fit.edu/code/svn/cse2410f13team7/wireshark/epan/dissectors/packet-ieee80211-radiotap.c
2) http://www.radiotap.org/fields/VHT.html

The first link mentions that meaning of 20 MHz, channel 1/4 is IEEE80211_RADIOTAP_VHT_BW_20LL. The second link gives the meaning of 20 LL, mentioning that the total bandwidth in 20 LL is 80 MHz.

Can anyone tell me the correct meaning of this vht bandwidth representation in wireshark : 20 MHz, channel 1/4 ?

asked 29 Oct '16, 00:30

Harshada%20Kelkar's gravatar image

Harshada Kelkar
21337
accept rate: 0%

edited 29 Oct '16, 02:38

Can you provide us the frame in a trace or at least a screenshot?

(29 Oct '16, 01:34) Christian_R

Edited the question.. added the capture screenshot and the links I had searched for this.

(29 Oct '16, 02:34) Harshada Kelkar

2 Answers:

1

I see this too:

alt text

Since the 802.11ac channel is 80MHz, that is four bonded channels. We can usually choose which is the primary. In my case, I have chosen (for test) to set primary to channel 157, which would be 3 / 4:

149 153 157 161

from here.

When I migrate the primary channel to 149, I get slightly different results:

alt text

So this is representing the primary channel from the channel bonded set. This is the channel beacons come out on, as well as other control traffic.

To manipulate yourself, see if you can change the primary channel in the 802.11ac configuration like I did. This is a Ruckus Wireless AP, standalone, that allows me to change this. Also note that I expect 80MHz communications in both direction, but for whatever reason, right after association, the FromDS frames are 802.11ac 20MHz for a while, then comms goes 80MHz in both directions. I don't know why - signal strength is good. If I get 80MHz frames, you don't see the information you are looking for.

answered 29 Oct '16, 02:53

Bob%20Jones's gravatar image

Bob Jones
1.0k2515
accept rate: 21%

Thanks a lot... but then, when wireshark shows 20 MHz, channel 1/4, the bandwidth on which the AP runs at that instance is 20 MHz or 80 MHz? And sometimes it is displayed just as 80 MHz, and other times like 20 MHz, channel 1/4.... what is the difference between the representation 80 MHz and 20 MHz, channel 1/4?

(29 Oct '16, 03:59) Harshada Kelkar

As explained in the last paragraph, those frames labelled 20MHz are sent at 20MHz 802.11ac. The frames labeled 80MHz are sent at 80MHz bandwidth.

So the difference: 80MHz indicates it was sent at 80MHz bandwidth, and when it says 20MHz channel 1/4 it is sent at 20MHz with primary channel as indicated in the four channel set - per the link to the channel picture, could be 36, 52, 100, etc., depending on which four channels are selected for bonding to 80MHz.

Look at the rates, too: the indicated rate should be consistent with the MCS index table. For this sample communications, the HTC phone is a single stream, so rates are relatively low compared to what the AP could do with a more capable client.

(29 Oct '16, 04:19) Bob Jones

Thanks.... also not understanding what 40 MHz + 40 MHz lower means in my trace...which I have attached in my question above... does it mean the BW is 40 MHz or 80 MHz?

(04 Nov '16, 12:33) Harshada Kelkar

It means the BW is 40MHz. The exact string is dependent on where you are pulling from. I know of at least three bandwidth fields in the various fields; there are likely more:

wlan_radio.11ac.bandwidth radiotap.mcs.bw wlan_radio.11n.bandwidth

Check the different fields and you will see different strings. But in your case the one field only tells you 40MHz, the other field tells you more, which 20MHz channel is primary.

I suspect to get 40 + 40MHz lower you need to be in 802.11ac, but using 40MHz bandwidth with a lower primary channel.

if you find our answers useful, please accept them for others to know the question was answered.

(04 Nov '16, 13:47) Bob Jones

0

Please see here: https://crnetpackets.com/2015/06/23/basics-facts-about-wlan-standards-in-north-america-and-europe/ 1/4 meant 36 is the first 40,44and 48 are the other ones to achieve 80MHz .

answered 29 Oct '16, 02:55

Christian_R's gravatar image

Christian_R
1.8k2625
accept rate: 16%

edited 29 Oct '16, 06:31

sindy's gravatar image

sindy
6.0k4851