|
|
|
@ -1,5 +1,5 @@ |
|
|
|
|
AVS Capture Frame Format |
|
|
|
|
Version 2.1 |
|
|
|
|
Version 2.1.1 |
|
|
|
|
|
|
|
|
|
1. Introduction |
|
|
|
|
The original header format for "monitor mode" or capturing frames was |
|
|
|
@ -39,7 +39,7 @@ The following fields make up the AVS capture header: |
|
|
|
|
8 mactime uint64 |
|
|
|
|
16 hosttime uint64 |
|
|
|
|
24 phytype uint32 |
|
|
|
|
28 channel uint32 |
|
|
|
|
28 frequency uint32 |
|
|
|
|
32 datarate uint32 |
|
|
|
|
36 antenna uint32 |
|
|
|
|
40 priority uint32 |
|
|
|
@ -50,7 +50,7 @@ The following fields make up the AVS capture header: |
|
|
|
|
60 encoding uint32 |
|
|
|
|
64 sequence uint32 |
|
|
|
|
68 drops uint32 |
|
|
|
|
72 sniffer_addr uint8[6] |
|
|
|
|
72 receiver_addr uint8[6] |
|
|
|
|
78 padding uint8[2] |
|
|
|
|
------------------------------ |
|
|
|
|
80 |
|
|
|
@ -72,11 +72,17 @@ in bytes. |
|
|
|
|
Many WLAN devices supply a relatively high resolution frame reception |
|
|
|
|
time value. This field contains the value supplied by the device. If |
|
|
|
|
the device does not supply a receive time value, this field shall be |
|
|
|
|
set to zero. The units for this field are microseconds. |
|
|
|
|
set to zero. The units for this field are microseconds. |
|
|
|
|
|
|
|
|
|
If possible, this time value should be absolute, representing the number |
|
|
|
|
of microseconds elapsed since the UNIX epoch. |
|
|
|
|
|
|
|
|
|
4.4 hosttime |
|
|
|
|
The hosttime field is set to the current value of the host maintained |
|
|
|
|
clock variable when the frame is received. |
|
|
|
|
clock variable when the frame is received by the host. |
|
|
|
|
|
|
|
|
|
If possible, this time value should be absolute, representing the number |
|
|
|
|
of microseconds elapsed since the UNIX epoch. |
|
|
|
|
|
|
|
|
|
4.5 phytype |
|
|
|
|
The phytype field identifies what type of PHY is employed by the WLAN |
|
|
|
@ -94,11 +100,13 @@ device used to capture this frame. The valid values are: |
|
|
|
|
phytype_ofdm_dot11_a 8 |
|
|
|
|
phytype_dss_ofdm_dot11_g 9 |
|
|
|
|
|
|
|
|
|
4.6 channel |
|
|
|
|
For all PHY types except FH, this field is just an unsigned integer |
|
|
|
|
and will be set to the current receiver channel number at the time |
|
|
|
|
the frame was received. For frequency hopping radios, this field |
|
|
|
|
is broken in to the following subfields: |
|
|
|
|
4.6 frequency |
|
|
|
|
|
|
|
|
|
This represents the frequency or channel number of the receiver at the |
|
|
|
|
time the frame was received. It is interpreted as follows: |
|
|
|
|
|
|
|
|
|
For frequency hopping radios, this field is broken in to the |
|
|
|
|
following subfields: |
|
|
|
|
|
|
|
|
|
Byte Subfield |
|
|
|
|
------------------------ |
|
|
|
@ -107,6 +115,15 @@ is broken in to the following subfields: |
|
|
|
|
Byte2 Hop Index |
|
|
|
|
Byte3 reserved |
|
|
|
|
|
|
|
|
|
For non-hopping radios, the frequency is interpreted as follows: |
|
|
|
|
|
|
|
|
|
Value Meaning |
|
|
|
|
----------------------------------------- |
|
|
|
|
< 256 Channel number (using externally-defined |
|
|
|
|
channelization) |
|
|
|
|
< 10000 Center frequency, in MHz |
|
|
|
|
>= 10000 Center frequency, in KHz |
|
|
|
|
|
|
|
|
|
4.7 datarate |
|
|
|
|
The data rate field contains the rate at which the frame was received |
|
|
|
|
in units of 100kbps. |
|
|
|
@ -190,11 +207,10 @@ This is a counter of the number of known frame drops that occured. This |
|
|
|
|
is particularly useful when the system or hardware cannot keep up with |
|
|
|
|
the sniffer load. |
|
|
|
|
|
|
|
|
|
4.16 sniffer_addr |
|
|
|
|
This specifies the mac address of the sniffer, six octets in length. |
|
|
|
|
This field is followed by two octets of padding to keep the structure 32-bit |
|
|
|
|
word aligned. |
|
|
|
|
|
|
|
|
|
4.16 receiver_addr |
|
|
|
|
This specifies the MAC address of the receiver of this frame. |
|
|
|
|
It is six octets in length. This field is followed by two octets of |
|
|
|
|
padding to keep the structure 32-bit word aligned. |
|
|
|
|
|
|
|
|
|
================================ |
|
|
|
|
|
|
|
|
@ -207,3 +223,11 @@ Changes: v2->v2.1 |
|
|
|
|
* Mactime is specified in microseconds, not nanoseconds |
|
|
|
|
* Added 64QAM, 16QAM, BPSK, QPSK encodings |
|
|
|
|
|
|
|
|
|
================================ |
|
|
|
|
|
|
|
|
|
Changes: v2.1->v2.1.1 |
|
|
|
|
|
|
|
|
|
* Renamed 'channel' to 'frequency' |
|
|
|
|
* Clarified the interpretation of the frequency/channel field. |
|
|
|
|
* Renamed 'sniffer address' to 'receiver address' |
|
|
|
|
* Clarified timestamp fields. |
|
|
|
|