This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

radiotap header format data rate alignment

0

alt text

alt text

hi, I have attached a trace from wireshark. Can someone tell me from where the wireshark is decoding the rate to be 26 MBps. Clicking on the rate points to an invalid location. I am unable to find the reason behind why this is happening. Why is Also, Shouldnt data rate be a 2-byte value? The reason why I am asking is wireshark generally shows rate as (2*rate because unit is in 500KBps) in the bit representation(as seen in the second image). So any rate above 128 Mbps is going to exceed one byte. From the below images, it is visible that the radio tap header format is different for the two packets. Data in the images are obtained from doing tcpdump on monitor interfaces on two machines (one from a remote machine, another from the same machine as the client on the same physical device). The driver used in this case is ath5k. When is this the case? I am pretty confused regarding this and any help will be greatly appreciated.

Thank you srini

asked 09 Mar '12, 13:14

srini_wisc's gravatar image

srini_wisc
1335
accept rate: 0%

edited 09 Mar '12, 14:31

Does anybody have any comments on this? If the MCS information is showing the data rate, Can someone tell me how it is different from the data rate measured from the client? iwconfig shows a different data rate compare to the data rate in MCS. what does QoS data mean in the sense, does it have the actual data?

(15 Mar '12, 17:53) srini_wisc

One Answer:

2

Well, you've asked several questions here.

Can someone tell me from where the wireshark is decoding the rate to be 26 MBps. Clicking on the rate points to an invalid location.

What do you mean by "an invalid location"? The screenshot shows an offset of 0x1A = 26; it also says the radiotap header length is 29, so that's within the radiotap header.

For 802.11n, the rate is likely to come from the MCS field; it's calculated based on the MCS index, channel width, and guard interval length in that field.

Shouldnt data rate be a 2-byte value? The reason why I am asking is wireshark generally shows rate as (2*rate because unit is in 500KBps) in the bit representation(as seen in the second image). So any rate above 128 Mbps is going to exceed one byte

Again, for 802.11n, the data rate is NOT represented by a Rate field, it's calculated from the values in the MCS field. The MCS field is 3 bytes long; the rate should probably be shown as a calculated value and, when clicked on, select all 3 bytes.

From the below images, it is visible that the radio tap header format is different for the two packets.

Yes. The first capture is 802.11n; the second capture is probably not 802.11n (it says 802.11a).

If the MCS information is showing the data rate, Can someone tell me how it is different from the data rate measured from the client?

What do you mean by "measured"? "Measured" as in "counting the number of bits of data received within a specified amount of time and dividing the bits by the number of time"?

iwconfig shows a different data rate compare to the data rate in MCS.

What is iwconfig showing?

what does QoS data mean in the sense, does it have the actual data?

"QoS data" means that the frame is a QoS Data frame, i.e. a Data frame with a QoS header. See sections 7.1.3.1.2 "Type and Subtype fields", 7.1.3.5 "QoS Control field", and 7.2.2 "Data frames" of IEEE Std 802.11-2007.

answered 16 Mar '12, 23:47

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%

I've checked into the trunk a change to show the Data Rate as a calculated field, and make it cover all 3 bytes of the MCS field, if it's calculated from items in that field, and will schedule it for the 1.6 branch.

(17 Mar '12, 14:47) Guy Harris ♦♦

hi, Thanks for the clarification. I can understand a lot of things now from your reply. By mentioning measured "I meant the data rate value from iwconfig". iwconfig at the client shows 130 MbpS where as the one read from my monitor interface is 39 MbpS. Is iwconfig meant to work with 802.11n traffic?

(19 Mar '12, 12:44) srini_wisc
1

Looking at the iwconfig source as downloaded from here, it prints, somewhere, "Bit Rate" followed by a bit rate, fetched with the SIOCGIWRATE ioctl. I would have to spend a lot of time looking at the Linux kernel source to see where the bit rate comes from in the ath5k driver; if you have any questions about the value returned by iwconfig, I suggest you ask somebody in the Linux wireless networking community, as I have no time to search for an answer for them.

(19 Mar '12, 20:21) Guy Harris ♦♦