I have another problem that I don't understand, I have filtered to radiotap.vht.datarate.0 and wlan.fc.type_subtype == 0x28 but the graph don't show a higher datarate (180-200 Mbit/s) as the two N devices with maximum of 150 Mbit/s:
I have another question, what is the difference between radiotap.vht.datarate.0/radiotap.vht.datarate.1/radiotap.vht.datarate.2/radiotap.vht.datarate.3/radiotap.vht.datarate.4?
asked 17 Feb '17, 00:12
converted 18 Feb '17, 02:05
If you look at the radiotap header VHT definitions, they define a number of fields for up to four users:
Defined are number of spatial streams, MCS index, and coding(BCC or LDPC). Based on this, I believe these fields represent MU-MIMO capabilities. Since these specific ones do not appear to be part of the defined radiotap fields, I suspect they are derived quantities from items that are present, such as MCS Index, bandwidth, guard interval, etc., which would en masse define the datarate, per the MCS Index table.
Since an AP could send data to up to four clients at the same time with MU_MIMO, and the clients could be all different with different capabilities, RF environment, etc., it seems reasonable that they could all have a different Tx rate assigned per the algorithm radios use to Tx data.
Another reference is here.
Note that your analysis can be a little bit tricky in that 802.11ac clients can send frames at max datarate, or something less, all the way down to plain-old 802.11a rates. If you are analyzing all the traffic, be careful when just looking at specific datarate fields in the header for VHT, HT, etc., because if the datarate falls for whatever reason (distance, sudden rf environment change, etc) you might miss it. This is why the
field could be of significant value - with luck it captures all the datarates into one field in which case you could then analyze just this one field.
answered 18 Feb '17, 05:23
You need to enter values for the 3 fields: Display Filter, Y-Axis, and Y-Field.
In the display filter, you enter the filter expression you would like to use. For example, I entered the IP address of the WiFi Client (ip.addr==192.168.0.101). The graph will only display information pertaining to the Client with IP address 192.168.0.101
The Y-axis must be selected as Max, Min or Average. Then the Y-field would be wlan_radio.data_rate
Your graph would look like something like this:
Again, this is not the optimal solution since Wireshark only graphs based on time (sec) as opposed to frame numbers.
answered 18 Feb '17, 06:23