Wireshark · Wireshark-dev: Re: [Wireshark-dev] 802.11 timeline view and aggregation

[Alexis La Goutte <alexis.lagoutte@xxxxxxxxx>]

Hi Simon,

Nice feature, i can great to push on upstream too.

About you question, i think the better solution is the solution 2.

Regards,

On Sat, May 30, 2015 at 6:04 AM, Simon Barber <simon.barber@xxxxxxxxxx> wrote:

A few years ago I wrote an extension for Wireshark that allows 802.11 frames to be viewed on a zoomable, scrollable timeline in a third pane added to the main display.

https://github.com/parc-wifi/wireshark

I'm now working on updating and revamping that code to support 802.11n and 802.11ac, and porting it to the new QT UI.

802.11n added aggregation as a new feature. Most wireless cards do the de-aggregation in the hardware, and deliver the individual MPDU frames to the driver. As a result all the radiotap captures I have seen have multiple frames in the capture where on the air there was only a single physical layer aggregate frame (A-MPDU). Since this extension to wireshark is calculating and exposing physical layer properties (inter frame spaces and timings) it needs to work with physical layer frames. I have a design question. Should I

1. pre-process the capture files to re-aggregate the MPDUs into single A-MPDU frames (a single A-MPDU shows up in wireshark as a single packet, containing multiple 802.11 MPDUs)

or

2. somehow track the A-MPDUs within wireshark, perhaps using the 'conversation' feature. (frames show up in the packet list as they do now - each MPDU is a separate packet in wireshark, and the timeline view needs to be smart as to how it displays them).

Simon

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives:    https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe