Wireshark-dev: Re: [Wireshark-dev] Patch to add read support for Shomiti wireless captures
Here is a capture in the wireless Shomiti format. This capture is of an
association between a Linksys 802.11n client and AP. I am working on some
decodes for 802.11n that I will try to send in shortly.
In another email you asked what the meaning of the various header fields
were.
pad[4] contains 3 bytes of FF followed by the length of the remaining header
(8)
undecrypt[2] contains a bitmask (big endian)
Bits 0 to 2 is the mac port the packet was received on
Bit 3 unused
Bit 4 PCF Flag (Packet received outside of contention)
Bits 5 to 7 is the message type (I think it's always 0 for a normal
packet)
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 18 Jan 2007 12:53:04 -0800
On Jan 17, 2007, at 8:37 AM, Clay Jones wrote:
This patch adds support for the Shomiti wireless packet format. This is
the
format used by the Fluke Networks WNA (Wireless Network Analyzer).
What are the fields that aren't mapped to 802.11 pseudo-header fields,
namely
"preamble", "code", and "qual"? (Presumably "channel" is a channel number,
"rate" is the data rate in 500Kb/s units, and "signal" is signal strength
as
a percentage.
Do you have any captures we can use for testing?
Attachment:
linksys_n_assoc_40mhz.cap
Description: Binary data
