|
|
|
|
@ -1,10 +1,12 @@
|
|
|
|
|
AVS Capture Frame Format
|
|
|
|
|
Version 2
|
|
|
|
|
Version 2.1
|
|
|
|
|
|
|
|
|
|
1. Introduction
|
|
|
|
|
The original header format for "monitor mode" or capturing frames was
|
|
|
|
|
a considerable hack. The document covers a redesign of that format.
|
|
|
|
|
|
|
|
|
|
Any questions, corrections, or proposed changes go to info@linux-wlan.com
|
|
|
|
|
|
|
|
|
|
2. Frame Format
|
|
|
|
|
All sniff frames follow the same format:
|
|
|
|
|
|
|
|
|
|
@ -46,8 +48,10 @@ The following fields make up the AVS capture header:
|
|
|
|
|
52 ssi_noise int32
|
|
|
|
|
56 preamble uint32
|
|
|
|
|
60 encoding uint32
|
|
|
|
|
64 sniffer_addr uint8[6]
|
|
|
|
|
70 padding uint8[2]
|
|
|
|
|
------------------------------
|
|
|
|
|
64
|
|
|
|
|
72
|
|
|
|
|
|
|
|
|
|
The following subsections detail the fields of the capture header.
|
|
|
|
|
|
|
|
|
|
@ -55,7 +59,7 @@ The following subsections detail the fields of the capture header.
|
|
|
|
|
The version field identifies this type of frame as a subtype of
|
|
|
|
|
ETH_P_802111_CAPTURE as received by an ARPHRD_IEEE80211_PRISM or
|
|
|
|
|
an ARPHRD_IEEE80211_CAPTURE device. The value of this field shall be
|
|
|
|
|
0x80211001. As new revisions of this header are necessary, we can
|
|
|
|
|
0x80211002. As new revisions of this header are necessary, we can
|
|
|
|
|
increment the version appropriately.
|
|
|
|
|
|
|
|
|
|
4.2 length
|
|
|
|
|
@ -66,7 +70,7 @@ in bytes.
|
|
|
|
|
Many WLAN devices supply a relatively high resolution frame reception
|
|
|
|
|
time value. This field contains the value supplied by the device. If
|
|
|
|
|
the device does not supply a receive time value, this field shall be
|
|
|
|
|
set to zero. The units for this field are nanoseconds.
|
|
|
|
|
set to zero. The units for this field are microseconds.
|
|
|
|
|
|
|
|
|
|
4.4 hosttime
|
|
|
|
|
The hosttime field is set to the current value of the host maintained
|
|
|
|
|
@ -167,4 +171,24 @@ multiple encoding types, this will tell us which one was used.
|
|
|
|
|
2 PBCC
|
|
|
|
|
3 OFDM
|
|
|
|
|
4 DSSS-OFDM
|
|
|
|
|
5 BPSK
|
|
|
|
|
6 QPSK
|
|
|
|
|
7 16QAM
|
|
|
|
|
8 64QAM
|
|
|
|
|
|
|
|
|
|
4.14 sniffer_addr
|
|
|
|
|
This specifies the mac address of the sniffer, six octets in length.
|
|
|
|
|
This field is followed by two octets of padding to keep the structure 32-bit
|
|
|
|
|
word aligned.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
================================
|
|
|
|
|
|
|
|
|
|
Changes: v2->v2.1
|
|
|
|
|
|
|
|
|
|
* Added contact e-mail address to introduction
|
|
|
|
|
* Added sniffer_addr header, bringing total length to 72 bytes
|
|
|
|
|
* Bumped version to 0x80211002
|
|
|
|
|
* Mactime is specified in microseconds, not nanoseconds
|
|
|
|
|
* Added 64QAM, 16QAM, BPSK, QPSK encodings
|
|
|
|
|
|
|
|
|
|
|
solomon
17 years ago