2010-07-19 18:00:20 +00:00
|
|
|
/*
|
2012-05-02 04:03:49 +00:00
|
|
|
* packet-ieee80211-netmon.c
|
2012-03-06 16:58:09 +00:00
|
|
|
* Decode packets with a Network Monitor 802.11 radio header
|
2010-07-19 18:00:20 +00:00
|
|
|
*
|
|
|
|
* Wireshark - Network traffic analyzer
|
|
|
|
* By Gerald Combs <gerald@wireshark.org>
|
|
|
|
* Copyright 1998 Gerald Combs
|
|
|
|
*
|
2018-02-12 11:23:27 +00:00
|
|
|
* SPDX-License-Identifier: GPL-2.0-or-later
|
2010-07-19 18:00:20 +00:00
|
|
|
*/
|
|
|
|
|
2012-09-20 02:03:38 +00:00
|
|
|
#include "config.h"
|
2010-07-19 18:00:20 +00:00
|
|
|
|
|
|
|
#include <epan/packet.h>
|
Clean up 802.11 radio information handling.
Have a field that holds the PHY type but nothing else. Have
a union with structures holding PHY-type-specific information, as a
bunch of attributes are PHY-specific.
If we have a channel and band, but don't have the frequency, attempt to
calculate the frequency, and add that to the radio information if we
succeed. If we have the frequency, but don't have the channel, attempt
to calculate the channel, and add that to the radio information if we
succeed.
Handle FHSS information, 11a "half/quarter-clocked" and turbo
information, 11g normal vs. Super G, additional 11n and 11ac
information, and the "short preamble" flag for 11b and 11g.
Add a PHY type for 11 legacy DSSS and detect it if possible.
Clean up the AVS dissector - make all fields wlancap. fields (if you
want generic fields, use the wlan_radio. fields).
Set more fields when writing out Commview Wi-Fi files.
Change-Id: I691ac59f5e9e1a23779b56a65124049914b72e69
Reviewed-on: https://code.wireshark.org/review/9146
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-25 19:14:39 +00:00
|
|
|
|
2013-11-29 20:53:00 +00:00
|
|
|
#include <wiretap/wtap.h>
|
2010-07-19 18:00:20 +00:00
|
|
|
|
2021-03-04 23:41:00 +00:00
|
|
|
#include <wsutil/802_11-utils.h>
|
Clean up 802.11 radio information handling.
Have a field that holds the PHY type but nothing else. Have
a union with structures holding PHY-type-specific information, as a
bunch of attributes are PHY-specific.
If we have a channel and band, but don't have the frequency, attempt to
calculate the frequency, and add that to the radio information if we
succeed. If we have the frequency, but don't have the channel, attempt
to calculate the channel, and add that to the radio information if we
succeed.
Handle FHSS information, 11a "half/quarter-clocked" and turbo
information, 11g normal vs. Super G, additional 11n and 11ac
information, and the "short preamble" flag for 11b and 11g.
Add a PHY type for 11 legacy DSSS and detect it if possible.
Clean up the AVS dissector - make all fields wlancap. fields (if you
want generic fields, use the wlan_radio. fields).
Set more fields when writing out Commview Wi-Fi files.
Change-Id: I691ac59f5e9e1a23779b56a65124049914b72e69
Reviewed-on: https://code.wireshark.org/review/9146
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-25 19:14:39 +00:00
|
|
|
|
2013-12-15 23:44:12 +00:00
|
|
|
void proto_register_netmon_802_11(void);
|
|
|
|
void proto_reg_handoff_netmon_802_11(void);
|
|
|
|
|
2010-07-19 18:00:20 +00:00
|
|
|
/* protocol */
|
|
|
|
static int proto_netmon_802_11 = -1;
|
|
|
|
|
2020-06-29 16:43:11 +00:00
|
|
|
/* Dissector */
|
|
|
|
static dissector_handle_t netmon_802_11_handle;
|
|
|
|
|
2012-03-06 16:58:09 +00:00
|
|
|
#define MIN_HEADER_LEN 32
|
2010-07-19 18:00:20 +00:00
|
|
|
|
|
|
|
/* op_mode */
|
2012-03-06 16:58:09 +00:00
|
|
|
#define OP_MODE_STA 0x00000001 /* station mode */
|
|
|
|
#define OP_MODE_AP 0x00000002 /* AP mode */
|
|
|
|
#define OP_MODE_STA_EXT 0x00000004 /* extensible station mode */
|
|
|
|
#define OP_MODE_MON 0x80000000 /* monitor mode */
|
2010-07-19 18:00:20 +00:00
|
|
|
|
|
|
|
/* phy_type */
|
2015-09-24 17:31:23 +00:00
|
|
|
/*
|
|
|
|
* Augmented with phy types from
|
|
|
|
*
|
2019-07-27 22:53:22 +00:00
|
|
|
* https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/content/windot11/ne-windot11-_dot11_phy_type
|
2015-09-24 17:31:23 +00:00
|
|
|
*/
|
|
|
|
#define PHY_TYPE_UNKNOWN 0
|
|
|
|
#define PHY_TYPE_FHSS 1
|
|
|
|
#define PHY_TYPE_DSSS 2
|
|
|
|
#define PHY_TYPE_IR_BASEBAND 3
|
|
|
|
#define PHY_TYPE_OFDM 4 /* 802.11a */
|
|
|
|
#define PHY_TYPE_HR_DSSS 5 /* 802.11b */
|
|
|
|
#define PHY_TYPE_ERP 6 /* 802.11g */
|
|
|
|
#define PHY_TYPE_HT 7 /* 802.11n */
|
|
|
|
#define PHY_TYPE_VHT 8 /* 802.11ac */
|
2010-07-19 18:00:20 +00:00
|
|
|
|
|
|
|
static int hf_netmon_802_11_version = -1;
|
|
|
|
static int hf_netmon_802_11_length = -1;
|
|
|
|
static int hf_netmon_802_11_op_mode = -1;
|
|
|
|
static int hf_netmon_802_11_op_mode_sta = -1;
|
|
|
|
static int hf_netmon_802_11_op_mode_ap = -1;
|
|
|
|
static int hf_netmon_802_11_op_mode_sta_ext = -1;
|
|
|
|
static int hf_netmon_802_11_op_mode_mon = -1;
|
2013-01-31 17:55:31 +00:00
|
|
|
/* static int hf_netmon_802_11_flags = -1; */
|
2010-07-19 18:00:20 +00:00
|
|
|
static int hf_netmon_802_11_phy_type = -1;
|
|
|
|
static int hf_netmon_802_11_channel = -1;
|
|
|
|
static int hf_netmon_802_11_frequency = -1;
|
|
|
|
static int hf_netmon_802_11_rssi = -1;
|
|
|
|
static int hf_netmon_802_11_datarate = -1;
|
|
|
|
static int hf_netmon_802_11_timestamp = -1;
|
|
|
|
|
|
|
|
static gint ett_netmon_802_11 = -1;
|
|
|
|
static gint ett_netmon_802_11_op_mode = -1;
|
|
|
|
|
2015-06-20 22:57:57 +00:00
|
|
|
static dissector_handle_t ieee80211_radio_handle;
|
2010-07-19 18:00:20 +00:00
|
|
|
|
2012-03-02 11:09:15 +00:00
|
|
|
static int
|
2021-04-02 07:45:57 +00:00
|
|
|
dissect_netmon_802_11(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_)
|
2010-07-19 18:00:20 +00:00
|
|
|
{
|
2021-04-02 07:45:57 +00:00
|
|
|
struct ieee_802_11_phdr phdr;
|
2015-06-20 22:57:57 +00:00
|
|
|
proto_tree *wlan_tree = NULL, *opmode_tree;
|
2010-07-19 18:00:20 +00:00
|
|
|
proto_item *ti;
|
2012-03-06 16:58:09 +00:00
|
|
|
tvbuff_t *next_tvb;
|
|
|
|
int offset;
|
|
|
|
guint8 version;
|
|
|
|
guint16 length;
|
2015-06-22 22:04:28 +00:00
|
|
|
guint32 phy_type;
|
2020-08-07 09:04:59 +00:00
|
|
|
guint32 monitor_mode;
|
2012-03-06 16:58:09 +00:00
|
|
|
guint32 flags;
|
|
|
|
guint32 channel;
|
Clean up 802.11 radio information handling.
Have a field that holds the PHY type but nothing else. Have
a union with structures holding PHY-type-specific information, as a
bunch of attributes are PHY-specific.
If we have a channel and band, but don't have the frequency, attempt to
calculate the frequency, and add that to the radio information if we
succeed. If we have the frequency, but don't have the channel, attempt
to calculate the channel, and add that to the radio information if we
succeed.
Handle FHSS information, 11a "half/quarter-clocked" and turbo
information, 11g normal vs. Super G, additional 11n and 11ac
information, and the "short preamble" flag for 11b and 11g.
Add a PHY type for 11 legacy DSSS and detect it if possible.
Clean up the AVS dissector - make all fields wlancap. fields (if you
want generic fields, use the wlan_radio. fields).
Set more fields when writing out Commview Wi-Fi files.
Change-Id: I691ac59f5e9e1a23779b56a65124049914b72e69
Reviewed-on: https://code.wireshark.org/review/9146
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-25 19:14:39 +00:00
|
|
|
gint calc_channel;
|
2012-03-06 16:58:09 +00:00
|
|
|
gint32 rssi;
|
|
|
|
guint8 rate;
|
2010-07-19 18:00:20 +00:00
|
|
|
|
2021-04-02 07:45:57 +00:00
|
|
|
/*
|
|
|
|
* It appears to be the case that management frames (and control and
|
|
|
|
* extension frames ?) may or may not have an FCS and data frames don't.
|
|
|
|
* (Netmon capture files have been seen for this encapsulation
|
|
|
|
* management frames either completely with or without an FCS. Also:
|
|
|
|
* instances have been seen where both Management and Control frames
|
|
|
|
* do not have an FCS). An "FCS length" of -2 means "NetMon weirdness".
|
|
|
|
*
|
|
|
|
* The metadata header also has a bit indicating whether the adapter
|
|
|
|
* was in monitor mode or not; if it isn't, we set "decrypted" to TRUE,
|
|
|
|
* as, for those frames, the Protected bit is preserved in received
|
|
|
|
* frames, but the frame is decrypted.
|
|
|
|
*/
|
|
|
|
memset(&phdr, 0, sizeof(phdr));
|
|
|
|
phdr.fcs_len = -2;
|
|
|
|
phdr.decrypted = FALSE;
|
|
|
|
phdr.datapad = FALSE;
|
|
|
|
phdr.phy = PHDR_802_11_PHY_UNKNOWN;
|
|
|
|
|
2010-07-19 18:00:20 +00:00
|
|
|
col_set_str(pinfo->cinfo, COL_PROTOCOL, "WLAN");
|
|
|
|
col_clear(pinfo->cinfo, COL_INFO);
|
|
|
|
offset = 0;
|
|
|
|
|
|
|
|
version = tvb_get_guint8(tvb, offset);
|
|
|
|
length = tvb_get_letohs(tvb, offset+1);
|
|
|
|
col_add_fstr(pinfo->cinfo, COL_INFO, "NetMon WLAN Capture v%u, Length %u",
|
|
|
|
version, length);
|
|
|
|
if (version != 2) {
|
|
|
|
/* XXX - complain */
|
|
|
|
goto skip;
|
|
|
|
}
|
|
|
|
if (length < MIN_HEADER_LEN) {
|
|
|
|
/* XXX - complain */
|
|
|
|
goto skip;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Dissect the packet */
|
2015-06-20 22:57:57 +00:00
|
|
|
ti = proto_tree_add_item(tree, proto_netmon_802_11, tvb, 0, length,
|
|
|
|
ENC_NA);
|
|
|
|
wlan_tree = proto_item_add_subtree(ti, ett_netmon_802_11);
|
2015-09-24 17:42:59 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* XXX - is this the NDIS_OBJECT_HEADER structure:
|
|
|
|
*
|
2019-07-27 22:53:22 +00:00
|
|
|
* https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/content/ntddndis/ns-ntddndis-_ndis_object_header
|
2015-09-24 17:42:59 +00:00
|
|
|
*
|
|
|
|
* at the beginning of a DOT11_EXTSTA_RECV_CONTEXT structure:
|
|
|
|
*
|
2019-07-27 22:53:22 +00:00
|
|
|
* https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/content/windot11/ns-windot11-dot11_extsta_recv_context
|
2015-09-24 17:42:59 +00:00
|
|
|
*
|
|
|
|
* If so, the byte at an offset of 0 would be the appropriate type for the
|
|
|
|
* structure following it, i.e. NDIS_OBJECT_TYPE_DEFAULT.
|
|
|
|
*/
|
2015-06-20 22:57:57 +00:00
|
|
|
proto_tree_add_item(wlan_tree, hf_netmon_802_11_version, tvb, offset, 1,
|
|
|
|
ENC_LITTLE_ENDIAN);
|
|
|
|
offset += 1;
|
|
|
|
proto_tree_add_item(wlan_tree, hf_netmon_802_11_length, tvb, offset, 2,
|
|
|
|
ENC_LITTLE_ENDIAN);
|
|
|
|
offset += 2;
|
2015-09-24 17:42:59 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* This isn't in the DOT11_EXTSTA_RECV_CONTEXT structure.
|
|
|
|
*/
|
2015-06-20 22:57:57 +00:00
|
|
|
ti = proto_tree_add_item(wlan_tree, hf_netmon_802_11_op_mode, tvb, offset,
|
|
|
|
4, ENC_LITTLE_ENDIAN);
|
|
|
|
opmode_tree = proto_item_add_subtree(ti, ett_netmon_802_11_op_mode);
|
|
|
|
proto_tree_add_item(opmode_tree, hf_netmon_802_11_op_mode_sta, tvb, offset,
|
|
|
|
4, ENC_LITTLE_ENDIAN);
|
|
|
|
proto_tree_add_item(opmode_tree, hf_netmon_802_11_op_mode_ap, tvb, offset,
|
|
|
|
4, ENC_LITTLE_ENDIAN);
|
|
|
|
proto_tree_add_item(opmode_tree, hf_netmon_802_11_op_mode_sta_ext, tvb,
|
|
|
|
offset, 4, ENC_LITTLE_ENDIAN);
|
2020-08-07 09:04:59 +00:00
|
|
|
proto_tree_add_item_ret_uint(opmode_tree, hf_netmon_802_11_op_mode_mon, tvb, offset,
|
|
|
|
4, ENC_LITTLE_ENDIAN, &monitor_mode);
|
|
|
|
if (!monitor_mode) {
|
|
|
|
/*
|
|
|
|
* If a NetMon capture is not done in monitor mode, we may see frames
|
|
|
|
* with the Protect bit set (because they were encrypted on the air)
|
|
|
|
* but that aren't encrypted (because they've been decrypted before
|
|
|
|
* being written to the file). This wasn't done in monitor mode, as
|
|
|
|
* the "monitor mode" flag wasn't set, so supporess treating the
|
|
|
|
* Protect flag as an indication that the frame was encrypted.
|
|
|
|
*/
|
2021-04-02 07:45:57 +00:00
|
|
|
phdr.decrypted = TRUE;
|
2020-08-07 09:04:59 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Furthermore, we may see frames with the A-MSDU Present flag set
|
|
|
|
* in the QoS Control field but that have a regular frame, nto a
|
|
|
|
* sequence of A-MSDUs, in the payload.
|
|
|
|
*/
|
2021-04-02 07:45:57 +00:00
|
|
|
phdr.no_a_msdus = TRUE;
|
2020-08-07 09:04:59 +00:00
|
|
|
}
|
2015-06-20 22:57:57 +00:00
|
|
|
offset += 4;
|
2015-09-24 17:42:59 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* uReceiveFlags?
|
|
|
|
*/
|
2015-06-20 22:57:57 +00:00
|
|
|
flags = tvb_get_letohl(tvb, offset);
|
|
|
|
offset += 4;
|
|
|
|
if (flags != 0xffffffff) {
|
2015-09-24 17:42:59 +00:00
|
|
|
/*
|
|
|
|
* uPhyId?
|
|
|
|
*/
|
2015-06-22 22:04:28 +00:00
|
|
|
phy_type = tvb_get_letohl(tvb, offset);
|
2021-04-02 07:45:57 +00:00
|
|
|
memset(&phdr.phy_info, 0, sizeof(phdr.phy_info));
|
2015-12-09 22:26:46 +00:00
|
|
|
|
2021-03-10 09:42:51 +00:00
|
|
|
/*
|
|
|
|
* Unlike the channel flags in radiotap, this appears
|
|
|
|
* to correctly indicate the modulation for this packet
|
|
|
|
* (no cases seen where this doesn't match the data rate).
|
|
|
|
*/
|
2015-06-22 22:04:28 +00:00
|
|
|
switch (phy_type) {
|
|
|
|
|
2015-09-24 17:31:23 +00:00
|
|
|
case PHY_TYPE_UNKNOWN:
|
2021-04-02 07:45:57 +00:00
|
|
|
phdr.phy = PHDR_802_11_PHY_UNKNOWN;
|
2015-09-24 17:31:23 +00:00
|
|
|
break;
|
|
|
|
|
|
|
|
case PHY_TYPE_FHSS:
|
2021-04-02 07:45:57 +00:00
|
|
|
phdr.phy = PHDR_802_11_PHY_11_FHSS;
|
2015-09-24 17:31:23 +00:00
|
|
|
break;
|
|
|
|
|
|
|
|
case PHY_TYPE_IR_BASEBAND:
|
2021-04-02 07:45:57 +00:00
|
|
|
phdr.phy = PHDR_802_11_PHY_11_IR;
|
2015-09-24 17:31:23 +00:00
|
|
|
break;
|
|
|
|
|
|
|
|
case PHY_TYPE_DSSS:
|
2021-04-02 07:45:57 +00:00
|
|
|
phdr.phy = PHDR_802_11_PHY_11_DSSS;
|
2015-09-24 17:31:23 +00:00
|
|
|
break;
|
|
|
|
|
|
|
|
case PHY_TYPE_HR_DSSS:
|
2021-04-02 07:45:57 +00:00
|
|
|
phdr.phy = PHDR_802_11_PHY_11B;
|
2015-06-22 22:04:28 +00:00
|
|
|
break;
|
|
|
|
|
2015-09-24 17:31:23 +00:00
|
|
|
case PHY_TYPE_OFDM:
|
2021-04-02 07:45:57 +00:00
|
|
|
phdr.phy = PHDR_802_11_PHY_11A;
|
2015-06-22 22:04:28 +00:00
|
|
|
break;
|
|
|
|
|
2015-09-24 17:31:23 +00:00
|
|
|
case PHY_TYPE_ERP:
|
2021-04-02 07:45:57 +00:00
|
|
|
phdr.phy = PHDR_802_11_PHY_11G;
|
2015-06-22 22:04:28 +00:00
|
|
|
break;
|
|
|
|
|
2015-09-24 17:31:23 +00:00
|
|
|
case PHY_TYPE_HT:
|
2021-04-02 07:45:57 +00:00
|
|
|
phdr.phy = PHDR_802_11_PHY_11N;
|
Clean up 802.11 radio information handling.
Have a field that holds the PHY type but nothing else. Have
a union with structures holding PHY-type-specific information, as a
bunch of attributes are PHY-specific.
If we have a channel and band, but don't have the frequency, attempt to
calculate the frequency, and add that to the radio information if we
succeed. If we have the frequency, but don't have the channel, attempt
to calculate the channel, and add that to the radio information if we
succeed.
Handle FHSS information, 11a "half/quarter-clocked" and turbo
information, 11g normal vs. Super G, additional 11n and 11ac
information, and the "short preamble" flag for 11b and 11g.
Add a PHY type for 11 legacy DSSS and detect it if possible.
Clean up the AVS dissector - make all fields wlancap. fields (if you
want generic fields, use the wlan_radio. fields).
Set more fields when writing out Commview Wi-Fi files.
Change-Id: I691ac59f5e9e1a23779b56a65124049914b72e69
Reviewed-on: https://code.wireshark.org/review/9146
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-25 19:14:39 +00:00
|
|
|
break;
|
|
|
|
|
2015-09-24 17:31:23 +00:00
|
|
|
case PHY_TYPE_VHT:
|
2021-04-02 07:45:57 +00:00
|
|
|
phdr.phy = PHDR_802_11_PHY_11AC;
|
2015-09-24 17:31:23 +00:00
|
|
|
break;
|
|
|
|
|
Clean up 802.11 radio information handling.
Have a field that holds the PHY type but nothing else. Have
a union with structures holding PHY-type-specific information, as a
bunch of attributes are PHY-specific.
If we have a channel and band, but don't have the frequency, attempt to
calculate the frequency, and add that to the radio information if we
succeed. If we have the frequency, but don't have the channel, attempt
to calculate the channel, and add that to the radio information if we
succeed.
Handle FHSS information, 11a "half/quarter-clocked" and turbo
information, 11g normal vs. Super G, additional 11n and 11ac
information, and the "short preamble" flag for 11b and 11g.
Add a PHY type for 11 legacy DSSS and detect it if possible.
Clean up the AVS dissector - make all fields wlancap. fields (if you
want generic fields, use the wlan_radio. fields).
Set more fields when writing out Commview Wi-Fi files.
Change-Id: I691ac59f5e9e1a23779b56a65124049914b72e69
Reviewed-on: https://code.wireshark.org/review/9146
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-25 19:14:39 +00:00
|
|
|
default:
|
2021-04-02 07:45:57 +00:00
|
|
|
phdr.phy = PHDR_802_11_PHY_UNKNOWN;
|
2015-06-22 22:04:28 +00:00
|
|
|
break;
|
|
|
|
}
|
2015-06-20 22:57:57 +00:00
|
|
|
proto_tree_add_item(wlan_tree, hf_netmon_802_11_phy_type, tvb, offset, 4,
|
2010-07-19 18:00:20 +00:00
|
|
|
ENC_LITTLE_ENDIAN);
|
|
|
|
offset += 4;
|
2015-09-24 17:42:59 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* uChCenterFrequency?
|
|
|
|
*/
|
2015-06-20 22:57:57 +00:00
|
|
|
channel = tvb_get_letohl(tvb, offset);
|
|
|
|
if (channel < 1000) {
|
|
|
|
if (channel == 0) {
|
|
|
|
proto_tree_add_uint_format_value(wlan_tree, hf_netmon_802_11_channel,
|
|
|
|
tvb, offset, 4, channel,
|
|
|
|
"Unknown");
|
|
|
|
} else {
|
Clean up 802.11 radio information handling.
Have a field that holds the PHY type but nothing else. Have
a union with structures holding PHY-type-specific information, as a
bunch of attributes are PHY-specific.
If we have a channel and band, but don't have the frequency, attempt to
calculate the frequency, and add that to the radio information if we
succeed. If we have the frequency, but don't have the channel, attempt
to calculate the channel, and add that to the radio information if we
succeed.
Handle FHSS information, 11a "half/quarter-clocked" and turbo
information, 11g normal vs. Super G, additional 11n and 11ac
information, and the "short preamble" flag for 11b and 11g.
Add a PHY type for 11 legacy DSSS and detect it if possible.
Clean up the AVS dissector - make all fields wlancap. fields (if you
want generic fields, use the wlan_radio. fields).
Set more fields when writing out Commview Wi-Fi files.
Change-Id: I691ac59f5e9e1a23779b56a65124049914b72e69
Reviewed-on: https://code.wireshark.org/review/9146
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-25 19:14:39 +00:00
|
|
|
guint frequency;
|
|
|
|
|
2021-04-02 07:45:57 +00:00
|
|
|
phdr.has_channel = TRUE;
|
|
|
|
phdr.channel = channel;
|
2010-07-19 18:00:20 +00:00
|
|
|
proto_tree_add_uint(wlan_tree, hf_netmon_802_11_channel,
|
|
|
|
tvb, offset, 4, channel);
|
2021-04-02 07:45:57 +00:00
|
|
|
switch (phdr.phy) {
|
Clean up 802.11 radio information handling.
Have a field that holds the PHY type but nothing else. Have
a union with structures holding PHY-type-specific information, as a
bunch of attributes are PHY-specific.
If we have a channel and band, but don't have the frequency, attempt to
calculate the frequency, and add that to the radio information if we
succeed. If we have the frequency, but don't have the channel, attempt
to calculate the channel, and add that to the radio information if we
succeed.
Handle FHSS information, 11a "half/quarter-clocked" and turbo
information, 11g normal vs. Super G, additional 11n and 11ac
information, and the "short preamble" flag for 11b and 11g.
Add a PHY type for 11 legacy DSSS and detect it if possible.
Clean up the AVS dissector - make all fields wlancap. fields (if you
want generic fields, use the wlan_radio. fields).
Set more fields when writing out Commview Wi-Fi files.
Change-Id: I691ac59f5e9e1a23779b56a65124049914b72e69
Reviewed-on: https://code.wireshark.org/review/9146
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-25 19:14:39 +00:00
|
|
|
|
|
|
|
case PHDR_802_11_PHY_11B:
|
|
|
|
case PHDR_802_11_PHY_11G:
|
|
|
|
/* 2.4 GHz channel */
|
|
|
|
frequency = ieee80211_chan_to_mhz(channel, TRUE);
|
|
|
|
break;
|
|
|
|
|
|
|
|
case PHDR_802_11_PHY_11A:
|
|
|
|
/* 5 GHz channel */
|
|
|
|
frequency = ieee80211_chan_to_mhz(channel, FALSE);
|
|
|
|
break;
|
|
|
|
|
|
|
|
default:
|
|
|
|
frequency = 0;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
if (frequency != 0) {
|
2021-04-02 07:45:57 +00:00
|
|
|
phdr.has_frequency = TRUE;
|
|
|
|
phdr.frequency = frequency;
|
Clean up 802.11 radio information handling.
Have a field that holds the PHY type but nothing else. Have
a union with structures holding PHY-type-specific information, as a
bunch of attributes are PHY-specific.
If we have a channel and band, but don't have the frequency, attempt to
calculate the frequency, and add that to the radio information if we
succeed. If we have the frequency, but don't have the channel, attempt
to calculate the channel, and add that to the radio information if we
succeed.
Handle FHSS information, 11a "half/quarter-clocked" and turbo
information, 11g normal vs. Super G, additional 11n and 11ac
information, and the "short preamble" flag for 11b and 11g.
Add a PHY type for 11 legacy DSSS and detect it if possible.
Clean up the AVS dissector - make all fields wlancap. fields (if you
want generic fields, use the wlan_radio. fields).
Set more fields when writing out Commview Wi-Fi files.
Change-Id: I691ac59f5e9e1a23779b56a65124049914b72e69
Reviewed-on: https://code.wireshark.org/review/9146
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-25 19:14:39 +00:00
|
|
|
}
|
2010-07-19 18:00:20 +00:00
|
|
|
}
|
2015-06-20 22:57:57 +00:00
|
|
|
} else {
|
2021-04-02 07:45:57 +00:00
|
|
|
phdr.has_frequency = TRUE;
|
|
|
|
phdr.frequency = channel;
|
2016-12-13 19:26:27 +00:00
|
|
|
proto_tree_add_uint(wlan_tree, hf_netmon_802_11_frequency,
|
|
|
|
tvb, offset, 4, channel);
|
Clean up 802.11 radio information handling.
Have a field that holds the PHY type but nothing else. Have
a union with structures holding PHY-type-specific information, as a
bunch of attributes are PHY-specific.
If we have a channel and band, but don't have the frequency, attempt to
calculate the frequency, and add that to the radio information if we
succeed. If we have the frequency, but don't have the channel, attempt
to calculate the channel, and add that to the radio information if we
succeed.
Handle FHSS information, 11a "half/quarter-clocked" and turbo
information, 11g normal vs. Super G, additional 11n and 11ac
information, and the "short preamble" flag for 11b and 11g.
Add a PHY type for 11 legacy DSSS and detect it if possible.
Clean up the AVS dissector - make all fields wlancap. fields (if you
want generic fields, use the wlan_radio. fields).
Set more fields when writing out Commview Wi-Fi files.
Change-Id: I691ac59f5e9e1a23779b56a65124049914b72e69
Reviewed-on: https://code.wireshark.org/review/9146
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-25 19:14:39 +00:00
|
|
|
calc_channel = ieee80211_mhz_to_chan(channel);
|
|
|
|
if (calc_channel != -1) {
|
2021-04-02 07:45:57 +00:00
|
|
|
phdr.has_channel = TRUE;
|
|
|
|
phdr.channel = calc_channel;
|
Clean up 802.11 radio information handling.
Have a field that holds the PHY type but nothing else. Have
a union with structures holding PHY-type-specific information, as a
bunch of attributes are PHY-specific.
If we have a channel and band, but don't have the frequency, attempt to
calculate the frequency, and add that to the radio information if we
succeed. If we have the frequency, but don't have the channel, attempt
to calculate the channel, and add that to the radio information if we
succeed.
Handle FHSS information, 11a "half/quarter-clocked" and turbo
information, 11g normal vs. Super G, additional 11n and 11ac
information, and the "short preamble" flag for 11b and 11g.
Add a PHY type for 11 legacy DSSS and detect it if possible.
Clean up the AVS dissector - make all fields wlancap. fields (if you
want generic fields, use the wlan_radio. fields).
Set more fields when writing out Commview Wi-Fi files.
Change-Id: I691ac59f5e9e1a23779b56a65124049914b72e69
Reviewed-on: https://code.wireshark.org/review/9146
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-25 19:14:39 +00:00
|
|
|
}
|
2015-06-20 22:57:57 +00:00
|
|
|
}
|
|
|
|
offset += 4;
|
2015-09-24 17:42:59 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* usNumberOfMPDUsReceived is missing.
|
|
|
|
*/
|
|
|
|
|
|
|
|
/*
|
|
|
|
* lRSSI?
|
|
|
|
*/
|
2015-06-20 22:57:57 +00:00
|
|
|
rssi = tvb_get_letohl(tvb, offset);
|
|
|
|
if (rssi == 0) {
|
|
|
|
proto_tree_add_int_format_value(wlan_tree, hf_netmon_802_11_rssi,
|
|
|
|
tvb, offset, 4, rssi,
|
|
|
|
"Unknown");
|
|
|
|
} else {
|
2021-04-02 07:45:57 +00:00
|
|
|
phdr.has_signal_dbm = TRUE;
|
|
|
|
phdr.signal_dbm = rssi;
|
2010-07-19 18:00:20 +00:00
|
|
|
proto_tree_add_int_format_value(wlan_tree, hf_netmon_802_11_rssi,
|
|
|
|
tvb, offset, 4, rssi,
|
|
|
|
"%d dBm", rssi);
|
2015-06-20 22:57:57 +00:00
|
|
|
}
|
|
|
|
offset += 4;
|
2015-09-24 17:42:59 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* ucDataRate?
|
|
|
|
*/
|
2015-06-20 22:57:57 +00:00
|
|
|
rate = tvb_get_guint8(tvb, offset);
|
|
|
|
if (rate == 0) {
|
|
|
|
proto_tree_add_uint_format_value(wlan_tree, hf_netmon_802_11_datarate,
|
|
|
|
tvb, offset, 1, rate,
|
|
|
|
"Unknown");
|
|
|
|
} else {
|
2021-04-02 07:45:57 +00:00
|
|
|
phdr.has_data_rate = TRUE;
|
|
|
|
phdr.data_rate = rate;
|
2015-06-20 22:57:57 +00:00
|
|
|
proto_tree_add_uint_format_value(wlan_tree, hf_netmon_802_11_datarate,
|
|
|
|
tvb, offset, 1, rate,
|
|
|
|
"%f Mb/s", rate*.5);
|
|
|
|
}
|
|
|
|
offset += 1;
|
|
|
|
} else
|
|
|
|
offset += 13;
|
2015-09-24 17:42:59 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* ullTimestamp?
|
|
|
|
*
|
|
|
|
* If so, should this check the presense flag in flags?
|
|
|
|
*/
|
2021-04-02 07:45:57 +00:00
|
|
|
phdr.has_tsf_timestamp = TRUE;
|
|
|
|
phdr.tsf_timestamp = tvb_get_letoh64(tvb, offset);
|
2015-06-20 22:57:57 +00:00
|
|
|
proto_tree_add_item(wlan_tree, hf_netmon_802_11_timestamp, tvb, offset, 8,
|
|
|
|
ENC_LITTLE_ENDIAN);
|
|
|
|
/*offset += 8;*/
|
2012-03-02 11:09:15 +00:00
|
|
|
|
2010-07-19 18:00:20 +00:00
|
|
|
skip:
|
|
|
|
offset = length;
|
|
|
|
|
2015-06-20 22:57:57 +00:00
|
|
|
/* dissect the 802.11 packet next */
|
2012-03-06 16:58:09 +00:00
|
|
|
next_tvb = tvb_new_subset_remaining(tvb, offset);
|
2021-04-02 07:45:57 +00:00
|
|
|
call_dissector_with_data(ieee80211_radio_handle, next_tvb, pinfo, tree, &phdr);
|
2012-03-02 11:09:15 +00:00
|
|
|
return offset;
|
2010-07-19 18:00:20 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
void
|
|
|
|
proto_register_netmon_802_11(void)
|
|
|
|
{
|
|
|
|
static const value_string phy_type[] = {
|
2015-09-24 17:31:23 +00:00
|
|
|
{ PHY_TYPE_UNKNOWN, "Unknown" },
|
|
|
|
{ PHY_TYPE_FHSS, "802.11 FHSS" },
|
|
|
|
{ PHY_TYPE_DSSS, "802.11 DSSS" },
|
|
|
|
{ PHY_TYPE_IR_BASEBAND, "802.11 IR" },
|
|
|
|
{ PHY_TYPE_OFDM, "802.11a" },
|
|
|
|
{ PHY_TYPE_HR_DSSS, "802.11b" },
|
|
|
|
{ PHY_TYPE_ERP, "802.11g" },
|
|
|
|
{ PHY_TYPE_HT, "802.11n" },
|
|
|
|
{ PHY_TYPE_VHT, "802.11ac" },
|
2010-07-19 18:00:20 +00:00
|
|
|
{ 0, NULL },
|
|
|
|
};
|
|
|
|
|
|
|
|
static hf_register_info hf[] = {
|
|
|
|
{ &hf_netmon_802_11_version, { "Header revision", "netmon_802_11.version", FT_UINT8,
|
2012-03-06 16:58:09 +00:00
|
|
|
BASE_DEC, NULL, 0x0, NULL, HFILL } },
|
2010-07-19 18:00:20 +00:00
|
|
|
{ &hf_netmon_802_11_length, { "Header length", "netmon_802_11.length", FT_UINT16,
|
2012-03-06 16:58:09 +00:00
|
|
|
BASE_DEC, NULL, 0x0, NULL, HFILL } },
|
2010-07-19 18:00:20 +00:00
|
|
|
{ &hf_netmon_802_11_op_mode, { "Operation mode", "netmon_802_11.op_mode", FT_UINT32,
|
2012-03-06 16:58:09 +00:00
|
|
|
BASE_HEX, NULL, 0x0, NULL, HFILL } },
|
2010-07-19 18:00:20 +00:00
|
|
|
{ &hf_netmon_802_11_op_mode_sta, { "Station mode", "netmon_802_11.op_mode.sta", FT_UINT32,
|
2012-03-06 16:58:09 +00:00
|
|
|
BASE_HEX, NULL, OP_MODE_STA, NULL, HFILL } },
|
2010-07-19 18:00:20 +00:00
|
|
|
{ &hf_netmon_802_11_op_mode_ap, { "AP mode", "netmon_802_11.op_mode.ap", FT_UINT32,
|
2012-03-06 16:58:09 +00:00
|
|
|
BASE_HEX, NULL, OP_MODE_AP, NULL, HFILL } },
|
2010-07-19 18:00:20 +00:00
|
|
|
{ &hf_netmon_802_11_op_mode_sta_ext, { "Extensible station mode", "netmon_802_11.op_mode.sta_ext", FT_UINT32,
|
2012-03-06 16:58:09 +00:00
|
|
|
BASE_HEX, NULL, OP_MODE_STA_EXT, NULL, HFILL } },
|
2020-08-06 10:52:56 +00:00
|
|
|
{ &hf_netmon_802_11_op_mode_mon, { "Monitor mode", "netmon_802_11.op_mode.mon", FT_UINT32,
|
2012-03-06 16:58:09 +00:00
|
|
|
BASE_HEX, NULL, OP_MODE_MON, NULL, HFILL } },
|
2013-01-31 17:55:31 +00:00
|
|
|
#if 0
|
2010-07-19 18:00:20 +00:00
|
|
|
{ &hf_netmon_802_11_flags, { "Flags", "netmon_802_11.flags", FT_UINT32,
|
2012-03-06 16:58:09 +00:00
|
|
|
BASE_HEX, NULL, 0x0, NULL, HFILL } },
|
2013-01-31 17:55:31 +00:00
|
|
|
#endif
|
2010-07-19 18:00:20 +00:00
|
|
|
{ &hf_netmon_802_11_phy_type, { "PHY type", "netmon_802_11.phy_type", FT_UINT32,
|
2012-03-06 16:58:09 +00:00
|
|
|
BASE_DEC, VALS(phy_type), 0x0, NULL, HFILL } },
|
2010-07-19 18:00:20 +00:00
|
|
|
{ &hf_netmon_802_11_channel, { "Channel", "netmon_802_11.channel", FT_UINT32,
|
2012-03-06 16:58:09 +00:00
|
|
|
BASE_DEC, NULL, 0x0, NULL, HFILL } },
|
2010-07-19 18:00:20 +00:00
|
|
|
{ &hf_netmon_802_11_frequency, { "Center frequency", "netmon_802_11.frequency", FT_UINT32,
|
2016-12-13 19:26:27 +00:00
|
|
|
BASE_DEC|BASE_UNIT_STRING, &units_mhz, 0x0, NULL, HFILL } },
|
2010-07-19 18:00:20 +00:00
|
|
|
{ &hf_netmon_802_11_rssi, { "RSSI", "netmon_802_11.rssi", FT_INT32,
|
2012-03-06 16:58:09 +00:00
|
|
|
BASE_DEC, NULL, 0x0, NULL, HFILL } },
|
2010-07-19 18:00:20 +00:00
|
|
|
{ &hf_netmon_802_11_datarate, { "Data rate", "netmon_802_11.datarate", FT_UINT32,
|
2012-03-06 16:58:09 +00:00
|
|
|
BASE_DEC, NULL, 0x0, NULL, HFILL } },
|
2010-07-19 18:00:20 +00:00
|
|
|
/*
|
|
|
|
* XXX - is this host, or MAC, time stamp?
|
|
|
|
* It might be a FILETIME.
|
|
|
|
*/
|
|
|
|
{ &hf_netmon_802_11_timestamp, { "Timestamp", "netmon_802_11.timestamp", FT_UINT64,
|
2012-03-06 16:58:09 +00:00
|
|
|
BASE_DEC, NULL, 0x0, NULL, HFILL } },
|
2010-07-19 18:00:20 +00:00
|
|
|
};
|
|
|
|
static gint *ett[] = {
|
|
|
|
&ett_netmon_802_11,
|
|
|
|
&ett_netmon_802_11_op_mode
|
|
|
|
};
|
|
|
|
|
|
|
|
proto_netmon_802_11 = proto_register_protocol("NetMon 802.11 capture header",
|
|
|
|
"NetMon 802.11",
|
|
|
|
"netmon_802_11");
|
2020-06-29 16:43:11 +00:00
|
|
|
netmon_802_11_handle = register_dissector("netmon_802_11", dissect_netmon_802_11, proto_netmon_802_11);
|
2010-07-19 18:00:20 +00:00
|
|
|
proto_register_field_array(proto_netmon_802_11, hf, array_length(hf));
|
|
|
|
proto_register_subtree_array(ett, array_length(ett));
|
|
|
|
}
|
|
|
|
|
|
|
|
void
|
|
|
|
proto_reg_handoff_netmon_802_11(void)
|
|
|
|
{
|
2015-06-20 22:57:57 +00:00
|
|
|
/* handle for 802.11+radio information dissector */
|
2016-03-16 13:02:52 +00:00
|
|
|
ieee80211_radio_handle = find_dissector_add_dependency("wlan_radio", proto_netmon_802_11);
|
2012-05-02 03:11:00 +00:00
|
|
|
dissector_add_uint("wtap_encap", WTAP_ENCAP_IEEE_802_11_NETMON, netmon_802_11_handle);
|
2010-07-19 18:00:20 +00:00
|
|
|
}
|
2014-09-29 18:07:49 +00:00
|
|
|
|
|
|
|
/*
|
2019-07-26 18:43:17 +00:00
|
|
|
* Editor modelines - https://www.wireshark.org/tools/modelines.html
|
2014-09-29 18:07:49 +00:00
|
|
|
*
|
|
|
|
* Local Variables:
|
|
|
|
* c-basic-offset: 2
|
|
|
|
* tab-width: 8
|
|
|
|
* indent-tabs-mode: nil
|
|
|
|
* End:
|
|
|
|
*
|
|
|
|
* ex: set shiftwidth=2 tabstop=8 expandtab:
|
|
|
|
* :indentSize=2:tabSize=8:noTabs=true:
|
|
|
|
*/
|