Wireshark-dev: Re: [Wireshark-dev] [tcpdump-workers] What's the difference between NdisMediumBa
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Sat, 9 Apr 2016 19:22:17 -0700
On Apr 9, 2016, at 7:15 PM, Yang Luo <hsluoyb@xxxxxxxxx> wrote:

> And there's also a truncation from usDataRateValue (16 bits) to Radiotap "Rate" field (8 bits). I hope a direct assignment is OK:
> *((UCHAR*)Dot11RadiotapHeader + cur) = (UCHAR) usDataRateValue;

For pre-11n PHYs (the fastest of which are 11a and 11g), the maximum data rate is < 255*.5 ~= 127 Mb/s, so it fits.

For 11n and later PHYs, the data rate is calculated from values such as the MCS index; if the drivers aren't supplying that information (because they can't - Microsoft haven't updated the "Native Wi-Fi" radio metadata to handle 11n or 11ac), the drivers *might* be providing data rate values > 127 Mb/s, but there's not much we can do about that.