|
|
|
@ -1,5 +1,5 @@
|
|
|
|
|
AVS Capture Frame Format
|
|
|
|
|
Version 2.1
|
|
|
|
|
Version 2.1.1
|
|
|
|
|
|
|
|
|
|
1. Introduction
|
|
|
|
|
The original header format for "monitor mode" or capturing frames was
|
|
|
|
@ -39,7 +39,7 @@ The following fields make up the AVS capture header:
|
|
|
|
|
8 mactime uint64
|
|
|
|
|
16 hosttime uint64
|
|
|
|
|
24 phytype uint32
|
|
|
|
|
28 channel uint32
|
|
|
|
|
28 frequency uint32
|
|
|
|
|
32 datarate uint32
|
|
|
|
|
36 antenna uint32
|
|
|
|
|
40 priority uint32
|
|
|
|
@ -50,7 +50,7 @@ The following fields make up the AVS capture header:
|
|
|
|
|
60 encoding uint32
|
|
|
|
|
64 sequence uint32
|
|
|
|
|
68 drops uint32
|
|
|
|
|
72 sniffer_addr uint8[6]
|
|
|
|
|
72 receiver_addr uint8[6]
|
|
|
|
|
78 padding uint8[2]
|
|
|
|
|
------------------------------
|
|
|
|
|
80
|
|
|
|
@ -72,11 +72,17 @@ in bytes.
|
|
|
|
|
Many WLAN devices supply a relatively high resolution frame reception
|
|
|
|
|
time value. This field contains the value supplied by the device. If
|
|
|
|
|
the device does not supply a receive time value, this field shall be
|
|
|
|
|
set to zero. The units for this field are microseconds.
|
|
|
|
|
set to zero. The units for this field are microseconds.
|
|
|
|
|
|
|
|
|
|
If possible, this time value should be absolute, representing the number
|
|
|
|
|
of microseconds elapsed since the UNIX epoch.
|
|
|
|
|
|
|
|
|
|
4.4 hosttime
|
|
|
|
|
The hosttime field is set to the current value of the host maintained
|
|
|
|
|
clock variable when the frame is received.
|
|
|
|
|
clock variable when the frame is received by the host.
|
|
|
|
|
|
|
|
|
|
If possible, this time value should be absolute, representing the number
|
|
|
|
|
of microseconds elapsed since the UNIX epoch.
|
|
|
|
|
|
|
|
|
|
4.5 phytype
|
|
|
|
|
The phytype field identifies what type of PHY is employed by the WLAN
|
|
|
|
@ -94,11 +100,13 @@ device used to capture this frame. The valid values are:
|
|
|
|
|
phytype_ofdm_dot11_a 8
|
|
|
|
|
phytype_dss_ofdm_dot11_g 9
|
|
|
|
|
|
|
|
|
|
4.6 channel
|
|
|
|
|
For all PHY types except FH, this field is just an unsigned integer
|
|
|
|
|
and will be set to the current receiver channel number at the time
|
|
|
|
|
the frame was received. For frequency hopping radios, this field
|
|
|
|
|
is broken in to the following subfields:
|
|
|
|
|
4.6 frequency
|
|
|
|
|
|
|
|
|
|
This represents the frequency or channel number of the receiver at the
|
|
|
|
|
time the frame was received. It is interpreted as follows:
|
|
|
|
|
|
|
|
|
|
For frequency hopping radios, this field is broken in to the
|
|
|
|
|
following subfields:
|
|
|
|
|
|
|
|
|
|
Byte Subfield
|
|
|
|
|
------------------------
|
|
|
|
@ -107,6 +115,15 @@ is broken in to the following subfields:
|
|
|
|
|
Byte2 Hop Index
|
|
|
|
|
Byte3 reserved
|
|
|
|
|
|
|
|
|
|
For non-hopping radios, the frequency is interpreted as follows:
|
|
|
|
|
|
|
|
|
|
Value Meaning
|
|
|
|
|
-----------------------------------------
|
|
|
|
|
< 256 Channel number (using externally-defined
|
|
|
|
|
channelization)
|
|
|
|
|
< 10000 Center frequency, in MHz
|
|
|
|
|
>= 10000 Center frequency, in KHz
|
|
|
|
|
|
|
|
|
|
4.7 datarate
|
|
|
|
|
The data rate field contains the rate at which the frame was received
|
|
|
|
|
in units of 100kbps.
|
|
|
|
@ -190,11 +207,10 @@ This is a counter of the number of known frame drops that occured. This
|
|
|
|
|
is particularly useful when the system or hardware cannot keep up with
|
|
|
|
|
the sniffer load.
|
|
|
|
|
|
|
|
|
|
4.16 sniffer_addr
|
|
|
|
|
This specifies the mac address of the sniffer, six octets in length.
|
|
|
|
|
This field is followed by two octets of padding to keep the structure 32-bit
|
|
|
|
|
word aligned.
|
|
|
|
|
|
|
|
|
|
4.16 receiver_addr
|
|
|
|
|
This specifies the MAC address of the receiver of this frame.
|
|
|
|
|
It is six octets in length. This field is followed by two octets of
|
|
|
|
|
padding to keep the structure 32-bit word aligned.
|
|
|
|
|
|
|
|
|
|
================================
|
|
|
|
|
|
|
|
|
@ -207,3 +223,11 @@ Changes: v2->v2.1
|
|
|
|
|
* Mactime is specified in microseconds, not nanoseconds
|
|
|
|
|
* Added 64QAM, 16QAM, BPSK, QPSK encodings
|
|
|
|
|
|
|
|
|
|
================================
|
|
|
|
|
|
|
|
|
|
Changes: v2.1->v2.1.1
|
|
|
|
|
|
|
|
|
|
* Renamed 'channel' to 'frequency'
|
|
|
|
|
* Clarified the interpretation of the frequency/channel field.
|
|
|
|
|
* Renamed 'sniffer address' to 'receiver address'
|
|
|
|
|
* Clarified timestamp fields.
|
|
|
|
|