2010-07-19 18:00:20 +00:00
|
|
|
/*
|
2012-05-02 04:03:49 +00:00
|
|
|
* packet-ieee80211-netmon.c
|
2012-03-06 16:58:09 +00:00
|
|
|
* Decode packets with a Network Monitor 802.11 radio header
|
2010-07-19 18:00:20 +00:00
|
|
|
*
|
|
|
|
* Wireshark - Network traffic analyzer
|
|
|
|
* By Gerald Combs <gerald@wireshark.org>
|
|
|
|
* Copyright 1998 Gerald Combs
|
|
|
|
*
|
2018-02-12 11:23:27 +00:00
|
|
|
* SPDX-License-Identifier: GPL-2.0-or-later
|
2010-07-19 18:00:20 +00:00
|
|
|
*/
|
|
|
|
|
2012-09-20 02:03:38 +00:00
|
|
|
#include "config.h"
|
2010-07-19 18:00:20 +00:00
|
|
|
|
|
|
|
#include <epan/packet.h>
|
Clean up 802.11 radio information handling.
Have a field that holds the PHY type but nothing else. Have
a union with structures holding PHY-type-specific information, as a
bunch of attributes are PHY-specific.
If we have a channel and band, but don't have the frequency, attempt to
calculate the frequency, and add that to the radio information if we
succeed. If we have the frequency, but don't have the channel, attempt
to calculate the channel, and add that to the radio information if we
succeed.
Handle FHSS information, 11a "half/quarter-clocked" and turbo
information, 11g normal vs. Super G, additional 11n and 11ac
information, and the "short preamble" flag for 11b and 11g.
Add a PHY type for 11 legacy DSSS and detect it if possible.
Clean up the AVS dissector - make all fields wlancap. fields (if you
want generic fields, use the wlan_radio. fields).
Set more fields when writing out Commview Wi-Fi files.
Change-Id: I691ac59f5e9e1a23779b56a65124049914b72e69
Reviewed-on: https://code.wireshark.org/review/9146
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-25 19:14:39 +00:00
|
|
|
|
2013-11-29 20:53:00 +00:00
|
|
|
#include <wiretap/wtap.h>
|
2010-07-19 18:00:20 +00:00
|
|
|
|
Clean up 802.11 radio information handling.
Have a field that holds the PHY type but nothing else. Have
a union with structures holding PHY-type-specific information, as a
bunch of attributes are PHY-specific.
If we have a channel and band, but don't have the frequency, attempt to
calculate the frequency, and add that to the radio information if we
succeed. If we have the frequency, but don't have the channel, attempt
to calculate the channel, and add that to the radio information if we
succeed.
Handle FHSS information, 11a "half/quarter-clocked" and turbo
information, 11g normal vs. Super G, additional 11n and 11ac
information, and the "short preamble" flag for 11b and 11g.
Add a PHY type for 11 legacy DSSS and detect it if possible.
Clean up the AVS dissector - make all fields wlancap. fields (if you
want generic fields, use the wlan_radio. fields).
Set more fields when writing out Commview Wi-Fi files.
Change-Id: I691ac59f5e9e1a23779b56a65124049914b72e69
Reviewed-on: https://code.wireshark.org/review/9146
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-25 19:14:39 +00:00
|
|
|
#include <wsutil/frequency-utils.h>
|
|
|
|
|
2013-12-15 23:44:12 +00:00
|
|
|
void proto_register_netmon_802_11(void);
|
|
|
|
void proto_reg_handoff_netmon_802_11(void);
|
|
|
|
|
2010-07-19 18:00:20 +00:00
|
|
|
/* protocol */
|
|
|
|
static int proto_netmon_802_11 = -1;
|
|
|
|
|
2012-03-06 16:58:09 +00:00
|
|
|
#define MIN_HEADER_LEN 32
|
2010-07-19 18:00:20 +00:00
|
|
|
|
|
|
|
/* op_mode */
|
2012-03-06 16:58:09 +00:00
|
|
|
#define OP_MODE_STA 0x00000001 /* station mode */
|
|
|
|
#define OP_MODE_AP 0x00000002 /* AP mode */
|
|
|
|
#define OP_MODE_STA_EXT 0x00000004 /* extensible station mode */
|
|
|
|
#define OP_MODE_MON 0x80000000 /* monitor mode */
|
2010-07-19 18:00:20 +00:00
|
|
|
|
|
|
|
/* phy_type */
|
2015-09-24 17:31:23 +00:00
|
|
|
/*
|
|
|
|
* Augmented with phy types from
|
|
|
|
*
|
|
|
|
* https://msdn.microsoft.com/en-us/library/windows/hardware/ff548741(v=vs.85).aspx
|
|
|
|
*/
|
|
|
|
#define PHY_TYPE_UNKNOWN 0
|
|
|
|
#define PHY_TYPE_FHSS 1
|
|
|
|
#define PHY_TYPE_DSSS 2
|
|
|
|
#define PHY_TYPE_IR_BASEBAND 3
|
|
|
|
#define PHY_TYPE_OFDM 4 /* 802.11a */
|
|
|
|
#define PHY_TYPE_HR_DSSS 5 /* 802.11b */
|
|
|
|
#define PHY_TYPE_ERP 6 /* 802.11g */
|
|
|
|
#define PHY_TYPE_HT 7 /* 802.11n */
|
|
|
|
#define PHY_TYPE_VHT 8 /* 802.11ac */
|
2010-07-19 18:00:20 +00:00
|
|
|
|
|
|
|
static int hf_netmon_802_11_version = -1;
|
|
|
|
static int hf_netmon_802_11_length = -1;
|
|
|
|
static int hf_netmon_802_11_op_mode = -1;
|
|
|
|
static int hf_netmon_802_11_op_mode_sta = -1;
|
|
|
|
static int hf_netmon_802_11_op_mode_ap = -1;
|
|
|
|
static int hf_netmon_802_11_op_mode_sta_ext = -1;
|
|
|
|
static int hf_netmon_802_11_op_mode_mon = -1;
|
2013-01-31 17:55:31 +00:00
|
|
|
/* static int hf_netmon_802_11_flags = -1; */
|
2010-07-19 18:00:20 +00:00
|
|
|
static int hf_netmon_802_11_phy_type = -1;
|
|
|
|
static int hf_netmon_802_11_channel = -1;
|
|
|
|
static int hf_netmon_802_11_frequency = -1;
|
|
|
|
static int hf_netmon_802_11_rssi = -1;
|
|
|
|
static int hf_netmon_802_11_datarate = -1;
|
|
|
|
static int hf_netmon_802_11_timestamp = -1;
|
|
|
|
|
|
|
|
static gint ett_netmon_802_11 = -1;
|
|
|
|
static gint ett_netmon_802_11_op_mode = -1;
|
|
|
|
|
2015-06-20 22:57:57 +00:00
|
|
|
static dissector_handle_t ieee80211_radio_handle;
|
2010-07-19 18:00:20 +00:00
|
|
|
|
2012-03-02 11:09:15 +00:00
|
|
|
static int
|
2015-06-20 22:57:57 +00:00
|
|
|
dissect_netmon_802_11(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data)
|
2010-07-19 18:00:20 +00:00
|
|
|
{
|
2015-06-20 22:57:57 +00:00
|
|
|
struct ieee_802_11_phdr *phdr = (struct ieee_802_11_phdr *)data;
|
|
|
|
proto_tree *wlan_tree = NULL, *opmode_tree;
|
2010-07-19 18:00:20 +00:00
|
|
|
proto_item *ti;
|
2012-03-06 16:58:09 +00:00
|
|
|
tvbuff_t *next_tvb;
|
|
|
|
int offset;
|
|
|
|
guint8 version;
|
|
|
|
guint16 length;
|
2015-06-22 22:04:28 +00:00
|
|
|
guint32 phy_type;
|
2012-03-06 16:58:09 +00:00
|
|
|
guint32 flags;
|
|
|
|
guint32 channel;
|
Clean up 802.11 radio information handling.
Have a field that holds the PHY type but nothing else. Have
a union with structures holding PHY-type-specific information, as a
bunch of attributes are PHY-specific.
If we have a channel and band, but don't have the frequency, attempt to
calculate the frequency, and add that to the radio information if we
succeed. If we have the frequency, but don't have the channel, attempt
to calculate the channel, and add that to the radio information if we
succeed.
Handle FHSS information, 11a "half/quarter-clocked" and turbo
information, 11g normal vs. Super G, additional 11n and 11ac
information, and the "short preamble" flag for 11b and 11g.
Add a PHY type for 11 legacy DSSS and detect it if possible.
Clean up the AVS dissector - make all fields wlancap. fields (if you
want generic fields, use the wlan_radio. fields).
Set more fields when writing out Commview Wi-Fi files.
Change-Id: I691ac59f5e9e1a23779b56a65124049914b72e69
Reviewed-on: https://code.wireshark.org/review/9146
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-25 19:14:39 +00:00
|
|
|
gint calc_channel;
|
2012-03-06 16:58:09 +00:00
|
|
|
gint32 rssi;
|
|
|
|
guint8 rate;
|
2010-07-19 18:00:20 +00:00
|
|
|
|
|
|
|
col_set_str(pinfo->cinfo, COL_PROTOCOL, "WLAN");
|
|
|
|
col_clear(pinfo->cinfo, COL_INFO);
|
|
|
|
offset = 0;
|
|
|
|
|
|
|
|
version = tvb_get_guint8(tvb, offset);
|
|
|
|
length = tvb_get_letohs(tvb, offset+1);
|
|
|
|
col_add_fstr(pinfo->cinfo, COL_INFO, "NetMon WLAN Capture v%u, Length %u",
|
|
|
|
version, length);
|
|
|
|
if (version != 2) {
|
|
|
|
/* XXX - complain */
|
|
|
|
goto skip;
|
|
|
|
}
|
|
|
|
if (length < MIN_HEADER_LEN) {
|
|
|
|
/* XXX - complain */
|
|
|
|
goto skip;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Dissect the packet */
|
2015-06-20 22:57:57 +00:00
|
|
|
ti = proto_tree_add_item(tree, proto_netmon_802_11, tvb, 0, length,
|
|
|
|
ENC_NA);
|
|
|
|
wlan_tree = proto_item_add_subtree(ti, ett_netmon_802_11);
|
2015-09-24 17:42:59 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* XXX - is this the NDIS_OBJECT_HEADER structure:
|
|
|
|
*
|
|
|
|
* https://msdn.microsoft.com/en-us/library/windows/hardware/ff566588(v=vs.85).aspx
|
|
|
|
*
|
|
|
|
* at the beginning of a DOT11_EXTSTA_RECV_CONTEXT structure:
|
|
|
|
*
|
|
|
|
* https://msdn.microsoft.com/en-us/library/windows/hardware/ff548626(v=vs.85).aspx
|
|
|
|
*
|
|
|
|
* If so, the byte at an offset of 0 would be the appropriate type for the
|
|
|
|
* structure following it, i.e. NDIS_OBJECT_TYPE_DEFAULT.
|
|
|
|
*/
|
2015-06-20 22:57:57 +00:00
|
|
|
proto_tree_add_item(wlan_tree, hf_netmon_802_11_version, tvb, offset, 1,
|
|
|
|
ENC_LITTLE_ENDIAN);
|
|
|
|
offset += 1;
|
|
|
|
proto_tree_add_item(wlan_tree, hf_netmon_802_11_length, tvb, offset, 2,
|
|
|
|
ENC_LITTLE_ENDIAN);
|
|
|
|
offset += 2;
|
2015-09-24 17:42:59 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* This isn't in the DOT11_EXTSTA_RECV_CONTEXT structure.
|
|
|
|
*/
|
2015-06-20 22:57:57 +00:00
|
|
|
ti = proto_tree_add_item(wlan_tree, hf_netmon_802_11_op_mode, tvb, offset,
|
|
|
|
4, ENC_LITTLE_ENDIAN);
|
|
|
|
opmode_tree = proto_item_add_subtree(ti, ett_netmon_802_11_op_mode);
|
|
|
|
proto_tree_add_item(opmode_tree, hf_netmon_802_11_op_mode_sta, tvb, offset,
|
|
|
|
4, ENC_LITTLE_ENDIAN);
|
|
|
|
proto_tree_add_item(opmode_tree, hf_netmon_802_11_op_mode_ap, tvb, offset,
|
|
|
|
4, ENC_LITTLE_ENDIAN);
|
|
|
|
proto_tree_add_item(opmode_tree, hf_netmon_802_11_op_mode_sta_ext, tvb,
|
|
|
|
offset, 4, ENC_LITTLE_ENDIAN);
|
|
|
|
proto_tree_add_item(opmode_tree, hf_netmon_802_11_op_mode_mon, tvb, offset,
|
|
|
|
4, ENC_LITTLE_ENDIAN);
|
|
|
|
offset += 4;
|
2015-09-24 17:42:59 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* uReceiveFlags?
|
|
|
|
*/
|
2015-06-20 22:57:57 +00:00
|
|
|
flags = tvb_get_letohl(tvb, offset);
|
|
|
|
offset += 4;
|
|
|
|
if (flags != 0xffffffff) {
|
2015-09-24 17:42:59 +00:00
|
|
|
/*
|
|
|
|
* uPhyId?
|
|
|
|
*/
|
2015-06-22 22:04:28 +00:00
|
|
|
phy_type = tvb_get_letohl(tvb, offset);
|
2015-12-09 22:26:46 +00:00
|
|
|
memset(&phdr->phy_info, 0, sizeof(phdr->phy_info));
|
|
|
|
|
2015-06-22 22:04:28 +00:00
|
|
|
switch (phy_type) {
|
|
|
|
|
2015-09-24 17:31:23 +00:00
|
|
|
case PHY_TYPE_UNKNOWN:
|
|
|
|
phdr->phy = PHDR_802_11_PHY_UNKNOWN;
|
|
|
|
break;
|
|
|
|
|
|
|
|
case PHY_TYPE_FHSS:
|
|
|
|
phdr->phy = PHDR_802_11_PHY_11_FHSS;
|
|
|
|
break;
|
|
|
|
|
|
|
|
case PHY_TYPE_IR_BASEBAND:
|
|
|
|
phdr->phy = PHDR_802_11_PHY_11_IR;
|
|
|
|
break;
|
|
|
|
|
|
|
|
case PHY_TYPE_DSSS:
|
|
|
|
phdr->phy = PHDR_802_11_PHY_11_DSSS;
|
|
|
|
break;
|
|
|
|
|
|
|
|
case PHY_TYPE_HR_DSSS:
|
Clean up 802.11 radio information handling.
Have a field that holds the PHY type but nothing else. Have
a union with structures holding PHY-type-specific information, as a
bunch of attributes are PHY-specific.
If we have a channel and band, but don't have the frequency, attempt to
calculate the frequency, and add that to the radio information if we
succeed. If we have the frequency, but don't have the channel, attempt
to calculate the channel, and add that to the radio information if we
succeed.
Handle FHSS information, 11a "half/quarter-clocked" and turbo
information, 11g normal vs. Super G, additional 11n and 11ac
information, and the "short preamble" flag for 11b and 11g.
Add a PHY type for 11 legacy DSSS and detect it if possible.
Clean up the AVS dissector - make all fields wlancap. fields (if you
want generic fields, use the wlan_radio. fields).
Set more fields when writing out Commview Wi-Fi files.
Change-Id: I691ac59f5e9e1a23779b56a65124049914b72e69
Reviewed-on: https://code.wireshark.org/review/9146
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-25 19:14:39 +00:00
|
|
|
phdr->phy = PHDR_802_11_PHY_11B;
|
2015-06-22 22:04:28 +00:00
|
|
|
break;
|
|
|
|
|
2015-09-24 17:31:23 +00:00
|
|
|
case PHY_TYPE_OFDM:
|
Clean up 802.11 radio information handling.
Have a field that holds the PHY type but nothing else. Have
a union with structures holding PHY-type-specific information, as a
bunch of attributes are PHY-specific.
If we have a channel and band, but don't have the frequency, attempt to
calculate the frequency, and add that to the radio information if we
succeed. If we have the frequency, but don't have the channel, attempt
to calculate the channel, and add that to the radio information if we
succeed.
Handle FHSS information, 11a "half/quarter-clocked" and turbo
information, 11g normal vs. Super G, additional 11n and 11ac
information, and the "short preamble" flag for 11b and 11g.
Add a PHY type for 11 legacy DSSS and detect it if possible.
Clean up the AVS dissector - make all fields wlancap. fields (if you
want generic fields, use the wlan_radio. fields).
Set more fields when writing out Commview Wi-Fi files.
Change-Id: I691ac59f5e9e1a23779b56a65124049914b72e69
Reviewed-on: https://code.wireshark.org/review/9146
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-25 19:14:39 +00:00
|
|
|
phdr->phy = PHDR_802_11_PHY_11A;
|
2015-06-22 22:04:28 +00:00
|
|
|
break;
|
|
|
|
|
2015-09-24 17:31:23 +00:00
|
|
|
case PHY_TYPE_ERP:
|
Clean up 802.11 radio information handling.
Have a field that holds the PHY type but nothing else. Have
a union with structures holding PHY-type-specific information, as a
bunch of attributes are PHY-specific.
If we have a channel and band, but don't have the frequency, attempt to
calculate the frequency, and add that to the radio information if we
succeed. If we have the frequency, but don't have the channel, attempt
to calculate the channel, and add that to the radio information if we
succeed.
Handle FHSS information, 11a "half/quarter-clocked" and turbo
information, 11g normal vs. Super G, additional 11n and 11ac
information, and the "short preamble" flag for 11b and 11g.
Add a PHY type for 11 legacy DSSS and detect it if possible.
Clean up the AVS dissector - make all fields wlancap. fields (if you
want generic fields, use the wlan_radio. fields).
Set more fields when writing out Commview Wi-Fi files.
Change-Id: I691ac59f5e9e1a23779b56a65124049914b72e69
Reviewed-on: https://code.wireshark.org/review/9146
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-25 19:14:39 +00:00
|
|
|
phdr->phy = PHDR_802_11_PHY_11G;
|
2015-06-22 22:04:28 +00:00
|
|
|
break;
|
|
|
|
|
2015-09-24 17:31:23 +00:00
|
|
|
case PHY_TYPE_HT:
|
Clean up 802.11 radio information handling.
Have a field that holds the PHY type but nothing else. Have
a union with structures holding PHY-type-specific information, as a
bunch of attributes are PHY-specific.
If we have a channel and band, but don't have the frequency, attempt to
calculate the frequency, and add that to the radio information if we
succeed. If we have the frequency, but don't have the channel, attempt
to calculate the channel, and add that to the radio information if we
succeed.
Handle FHSS information, 11a "half/quarter-clocked" and turbo
information, 11g normal vs. Super G, additional 11n and 11ac
information, and the "short preamble" flag for 11b and 11g.
Add a PHY type for 11 legacy DSSS and detect it if possible.
Clean up the AVS dissector - make all fields wlancap. fields (if you
want generic fields, use the wlan_radio. fields).
Set more fields when writing out Commview Wi-Fi files.
Change-Id: I691ac59f5e9e1a23779b56a65124049914b72e69
Reviewed-on: https://code.wireshark.org/review/9146
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-25 19:14:39 +00:00
|
|
|
phdr->phy = PHDR_802_11_PHY_11N;
|
|
|
|
break;
|
|
|
|
|
2015-09-24 17:31:23 +00:00
|
|
|
case PHY_TYPE_VHT:
|
|
|
|
phdr->phy = PHDR_802_11_PHY_11AC;
|
|
|
|
break;
|
|
|
|
|
Clean up 802.11 radio information handling.
Have a field that holds the PHY type but nothing else. Have
a union with structures holding PHY-type-specific information, as a
bunch of attributes are PHY-specific.
If we have a channel and band, but don't have the frequency, attempt to
calculate the frequency, and add that to the radio information if we
succeed. If we have the frequency, but don't have the channel, attempt
to calculate the channel, and add that to the radio information if we
succeed.
Handle FHSS information, 11a "half/quarter-clocked" and turbo
information, 11g normal vs. Super G, additional 11n and 11ac
information, and the "short preamble" flag for 11b and 11g.
Add a PHY type for 11 legacy DSSS and detect it if possible.
Clean up the AVS dissector - make all fields wlancap. fields (if you
want generic fields, use the wlan_radio. fields).
Set more fields when writing out Commview Wi-Fi files.
Change-Id: I691ac59f5e9e1a23779b56a65124049914b72e69
Reviewed-on: https://code.wireshark.org/review/9146
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-25 19:14:39 +00:00
|
|
|
default:
|
|
|
|
phdr->phy = PHDR_802_11_PHY_UNKNOWN;
|
2015-06-22 22:04:28 +00:00
|
|
|
break;
|
|
|
|
}
|
2015-06-20 22:57:57 +00:00
|
|
|
proto_tree_add_item(wlan_tree, hf_netmon_802_11_phy_type, tvb, offset, 4,
|
2010-07-19 18:00:20 +00:00
|
|
|
ENC_LITTLE_ENDIAN);
|
|
|
|
offset += 4;
|
2015-09-24 17:42:59 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* uChCenterFrequency?
|
|
|
|
*/
|
2015-06-20 22:57:57 +00:00
|
|
|
channel = tvb_get_letohl(tvb, offset);
|
|
|
|
if (channel < 1000) {
|
|
|
|
if (channel == 0) {
|
|
|
|
proto_tree_add_uint_format_value(wlan_tree, hf_netmon_802_11_channel,
|
|
|
|
tvb, offset, 4, channel,
|
|
|
|
"Unknown");
|
|
|
|
} else {
|
Clean up 802.11 radio information handling.
Have a field that holds the PHY type but nothing else. Have
a union with structures holding PHY-type-specific information, as a
bunch of attributes are PHY-specific.
If we have a channel and band, but don't have the frequency, attempt to
calculate the frequency, and add that to the radio information if we
succeed. If we have the frequency, but don't have the channel, attempt
to calculate the channel, and add that to the radio information if we
succeed.
Handle FHSS information, 11a "half/quarter-clocked" and turbo
information, 11g normal vs. Super G, additional 11n and 11ac
information, and the "short preamble" flag for 11b and 11g.
Add a PHY type for 11 legacy DSSS and detect it if possible.
Clean up the AVS dissector - make all fields wlancap. fields (if you
want generic fields, use the wlan_radio. fields).
Set more fields when writing out Commview Wi-Fi files.
Change-Id: I691ac59f5e9e1a23779b56a65124049914b72e69
Reviewed-on: https://code.wireshark.org/review/9146
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-25 19:14:39 +00:00
|
|
|
guint frequency;
|
|
|
|
|
2015-12-09 22:26:46 +00:00
|
|
|
phdr->has_channel = TRUE;
|
2015-06-20 22:57:57 +00:00
|
|
|
phdr->channel = channel;
|
2010-07-19 18:00:20 +00:00
|
|
|
proto_tree_add_uint(wlan_tree, hf_netmon_802_11_channel,
|
|
|
|
tvb, offset, 4, channel);
|
Clean up 802.11 radio information handling.
Have a field that holds the PHY type but nothing else. Have
a union with structures holding PHY-type-specific information, as a
bunch of attributes are PHY-specific.
If we have a channel and band, but don't have the frequency, attempt to
calculate the frequency, and add that to the radio information if we
succeed. If we have the frequency, but don't have the channel, attempt
to calculate the channel, and add that to the radio information if we
succeed.
Handle FHSS information, 11a "half/quarter-clocked" and turbo
information, 11g normal vs. Super G, additional 11n and 11ac
information, and the "short preamble" flag for 11b and 11g.
Add a PHY type for 11 legacy DSSS and detect it if possible.
Clean up the AVS dissector - make all fields wlancap. fields (if you
want generic fields, use the wlan_radio. fields).
Set more fields when writing out Commview Wi-Fi files.
Change-Id: I691ac59f5e9e1a23779b56a65124049914b72e69
Reviewed-on: https://code.wireshark.org/review/9146
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-25 19:14:39 +00:00
|
|
|
switch (phdr->phy) {
|
|
|
|
|
|
|
|
case PHDR_802_11_PHY_11B:
|
|
|
|
case PHDR_802_11_PHY_11G:
|
|
|
|
/* 2.4 GHz channel */
|
|
|
|
frequency = ieee80211_chan_to_mhz(channel, TRUE);
|
|
|
|
break;
|
|
|
|
|
|
|
|
case PHDR_802_11_PHY_11A:
|
|
|
|
/* 5 GHz channel */
|
|
|
|
frequency = ieee80211_chan_to_mhz(channel, FALSE);
|
|
|
|
break;
|
|
|
|
|
|
|
|
default:
|
|
|
|
frequency = 0;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
if (frequency != 0) {
|
2015-12-09 22:26:46 +00:00
|
|
|
phdr->has_frequency = TRUE;
|
Clean up 802.11 radio information handling.
Have a field that holds the PHY type but nothing else. Have
a union with structures holding PHY-type-specific information, as a
bunch of attributes are PHY-specific.
If we have a channel and band, but don't have the frequency, attempt to
calculate the frequency, and add that to the radio information if we
succeed. If we have the frequency, but don't have the channel, attempt
to calculate the channel, and add that to the radio information if we
succeed.
Handle FHSS information, 11a "half/quarter-clocked" and turbo
information, 11g normal vs. Super G, additional 11n and 11ac
information, and the "short preamble" flag for 11b and 11g.
Add a PHY type for 11 legacy DSSS and detect it if possible.
Clean up the AVS dissector - make all fields wlancap. fields (if you
want generic fields, use the wlan_radio. fields).
Set more fields when writing out Commview Wi-Fi files.
Change-Id: I691ac59f5e9e1a23779b56a65124049914b72e69
Reviewed-on: https://code.wireshark.org/review/9146
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-25 19:14:39 +00:00
|
|
|
phdr->frequency = frequency;
|
|
|
|
}
|
2010-07-19 18:00:20 +00:00
|
|
|
}
|
2015-06-20 22:57:57 +00:00
|
|
|
} else {
|
2015-12-09 22:26:46 +00:00
|
|
|
phdr->has_frequency = TRUE;
|
2015-06-20 22:57:57 +00:00
|
|
|
phdr->frequency = channel;
|
2016-12-13 19:26:27 +00:00
|
|
|
proto_tree_add_uint(wlan_tree, hf_netmon_802_11_frequency,
|
|
|
|
tvb, offset, 4, channel);
|
Clean up 802.11 radio information handling.
Have a field that holds the PHY type but nothing else. Have
a union with structures holding PHY-type-specific information, as a
bunch of attributes are PHY-specific.
If we have a channel and band, but don't have the frequency, attempt to
calculate the frequency, and add that to the radio information if we
succeed. If we have the frequency, but don't have the channel, attempt
to calculate the channel, and add that to the radio information if we
succeed.
Handle FHSS information, 11a "half/quarter-clocked" and turbo
information, 11g normal vs. Super G, additional 11n and 11ac
information, and the "short preamble" flag for 11b and 11g.
Add a PHY type for 11 legacy DSSS and detect it if possible.
Clean up the AVS dissector - make all fields wlancap. fields (if you
want generic fields, use the wlan_radio. fields).
Set more fields when writing out Commview Wi-Fi files.
Change-Id: I691ac59f5e9e1a23779b56a65124049914b72e69
Reviewed-on: https://code.wireshark.org/review/9146
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-25 19:14:39 +00:00
|
|
|
calc_channel = ieee80211_mhz_to_chan(channel);
|
|
|
|
if (calc_channel != -1) {
|
2015-12-09 22:26:46 +00:00
|
|
|
phdr->has_channel = TRUE;
|
Clean up 802.11 radio information handling.
Have a field that holds the PHY type but nothing else. Have
a union with structures holding PHY-type-specific information, as a
bunch of attributes are PHY-specific.
If we have a channel and band, but don't have the frequency, attempt to
calculate the frequency, and add that to the radio information if we
succeed. If we have the frequency, but don't have the channel, attempt
to calculate the channel, and add that to the radio information if we
succeed.
Handle FHSS information, 11a "half/quarter-clocked" and turbo
information, 11g normal vs. Super G, additional 11n and 11ac
information, and the "short preamble" flag for 11b and 11g.
Add a PHY type for 11 legacy DSSS and detect it if possible.
Clean up the AVS dissector - make all fields wlancap. fields (if you
want generic fields, use the wlan_radio. fields).
Set more fields when writing out Commview Wi-Fi files.
Change-Id: I691ac59f5e9e1a23779b56a65124049914b72e69
Reviewed-on: https://code.wireshark.org/review/9146
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2015-06-25 19:14:39 +00:00
|
|
|
phdr->channel = calc_channel;
|
|
|
|
}
|
2015-06-20 22:57:57 +00:00
|
|
|
}
|
|
|
|
offset += 4;
|
2015-09-24 17:42:59 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* usNumberOfMPDUsReceived is missing.
|
|
|
|
*/
|
|
|
|
|
|
|
|
/*
|
|
|
|
* lRSSI?
|
|
|
|
*/
|
2015-06-20 22:57:57 +00:00
|
|
|
rssi = tvb_get_letohl(tvb, offset);
|
|
|
|
if (rssi == 0) {
|
|
|
|
proto_tree_add_int_format_value(wlan_tree, hf_netmon_802_11_rssi,
|
|
|
|
tvb, offset, 4, rssi,
|
|
|
|
"Unknown");
|
|
|
|
} else {
|
2015-12-09 22:26:46 +00:00
|
|
|
phdr->has_signal_dbm = TRUE;
|
2015-06-20 22:57:57 +00:00
|
|
|
phdr->signal_dbm = rssi;
|
2010-07-19 18:00:20 +00:00
|
|
|
proto_tree_add_int_format_value(wlan_tree, hf_netmon_802_11_rssi,
|
|
|
|
tvb, offset, 4, rssi,
|
|
|
|
"%d dBm", rssi);
|
2015-06-20 22:57:57 +00:00
|
|
|
}
|
|
|
|
offset += 4;
|
2015-09-24 17:42:59 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* ucDataRate?
|
|
|
|
*/
|
2015-06-20 22:57:57 +00:00
|
|
|
rate = tvb_get_guint8(tvb, offset);
|
|
|
|
if (rate == 0) {
|
|
|
|
proto_tree_add_uint_format_value(wlan_tree, hf_netmon_802_11_datarate,
|
|
|
|
tvb, offset, 1, rate,
|
|
|
|
"Unknown");
|
|
|
|
} else {
|
2015-12-09 22:26:46 +00:00
|
|
|
phdr->has_data_rate = TRUE;
|
2015-06-20 22:57:57 +00:00
|
|
|
phdr->data_rate = rate;
|
|
|
|
proto_tree_add_uint_format_value(wlan_tree, hf_netmon_802_11_datarate,
|
|
|
|
tvb, offset, 1, rate,
|
|
|
|
"%f Mb/s", rate*.5);
|
|
|
|
}
|
|
|
|
offset += 1;
|
|
|
|
} else
|
|
|
|
offset += 13;
|
2015-09-24 17:42:59 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* ullTimestamp?
|
|
|
|
*
|
|
|
|
* If so, should this check the presense flag in flags?
|
|
|
|
*/
|
2015-12-09 22:26:46 +00:00
|
|
|
phdr->has_tsf_timestamp = TRUE;
|
2015-06-20 22:57:57 +00:00
|
|
|
phdr->tsf_timestamp = tvb_get_letoh64(tvb, offset);
|
|
|
|
proto_tree_add_item(wlan_tree, hf_netmon_802_11_timestamp, tvb, offset, 8,
|
|
|
|
ENC_LITTLE_ENDIAN);
|
|
|
|
/*offset += 8;*/
|
2012-03-02 11:09:15 +00:00
|
|
|
|
2010-07-19 18:00:20 +00:00
|
|
|
skip:
|
|
|
|
offset = length;
|
|
|
|
|
2015-06-20 22:57:57 +00:00
|
|
|
/* dissect the 802.11 packet next */
|
2012-03-06 16:58:09 +00:00
|
|
|
next_tvb = tvb_new_subset_remaining(tvb, offset);
|
2015-06-20 22:57:57 +00:00
|
|
|
call_dissector_with_data(ieee80211_radio_handle, next_tvb, pinfo, tree, phdr);
|
2012-03-02 11:09:15 +00:00
|
|
|
return offset;
|
2010-07-19 18:00:20 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
void
|
|
|
|
proto_register_netmon_802_11(void)
|
|
|
|
{
|
|
|
|
static const value_string phy_type[] = {
|
2015-09-24 17:31:23 +00:00
|
|
|
{ PHY_TYPE_UNKNOWN, "Unknown" },
|
|
|
|
{ PHY_TYPE_FHSS, "802.11 FHSS" },
|
|
|
|
{ PHY_TYPE_DSSS, "802.11 DSSS" },
|
|
|
|
{ PHY_TYPE_IR_BASEBAND, "802.11 IR" },
|
|
|
|
{ PHY_TYPE_OFDM, "802.11a" },
|
|
|
|
{ PHY_TYPE_HR_DSSS, "802.11b" },
|
|
|
|
{ PHY_TYPE_ERP, "802.11g" },
|
|
|
|
{ PHY_TYPE_HT, "802.11n" },
|
|
|
|
{ PHY_TYPE_VHT, "802.11ac" },
|
2010-07-19 18:00:20 +00:00
|
|
|
{ 0, NULL },
|
|
|
|
};
|
|
|
|
|
|
|
|
static hf_register_info hf[] = {
|
|
|
|
{ &hf_netmon_802_11_version, { "Header revision", "netmon_802_11.version", FT_UINT8,
|
2012-03-06 16:58:09 +00:00
|
|
|
BASE_DEC, NULL, 0x0, NULL, HFILL } },
|
2010-07-19 18:00:20 +00:00
|
|
|
{ &hf_netmon_802_11_length, { "Header length", "netmon_802_11.length", FT_UINT16,
|
2012-03-06 16:58:09 +00:00
|
|
|
BASE_DEC, NULL, 0x0, NULL, HFILL } },
|
2010-07-19 18:00:20 +00:00
|
|
|
{ &hf_netmon_802_11_op_mode, { "Operation mode", "netmon_802_11.op_mode", FT_UINT32,
|
2012-03-06 16:58:09 +00:00
|
|
|
BASE_HEX, NULL, 0x0, NULL, HFILL } },
|
2010-07-19 18:00:20 +00:00
|
|
|
{ &hf_netmon_802_11_op_mode_sta, { "Station mode", "netmon_802_11.op_mode.sta", FT_UINT32,
|
2012-03-06 16:58:09 +00:00
|
|
|
BASE_HEX, NULL, OP_MODE_STA, NULL, HFILL } },
|
2010-07-19 18:00:20 +00:00
|
|
|
{ &hf_netmon_802_11_op_mode_ap, { "AP mode", "netmon_802_11.op_mode.ap", FT_UINT32,
|
2012-03-06 16:58:09 +00:00
|
|
|
BASE_HEX, NULL, OP_MODE_AP, NULL, HFILL } },
|
2010-07-19 18:00:20 +00:00
|
|
|
{ &hf_netmon_802_11_op_mode_sta_ext, { "Extensible station mode", "netmon_802_11.op_mode.sta_ext", FT_UINT32,
|
2012-03-06 16:58:09 +00:00
|
|
|
BASE_HEX, NULL, OP_MODE_STA_EXT, NULL, HFILL } },
|
2010-07-19 18:00:20 +00:00
|
|
|
{ &hf_netmon_802_11_op_mode_mon, { "Monitor mode", "netmon_802_11.op_mode.on", FT_UINT32,
|
2012-03-06 16:58:09 +00:00
|
|
|
BASE_HEX, NULL, OP_MODE_MON, NULL, HFILL } },
|
2013-01-31 17:55:31 +00:00
|
|
|
#if 0
|
2010-07-19 18:00:20 +00:00
|
|
|
{ &hf_netmon_802_11_flags, { "Flags", "netmon_802_11.flags", FT_UINT32,
|
2012-03-06 16:58:09 +00:00
|
|
|
BASE_HEX, NULL, 0x0, NULL, HFILL } },
|
2013-01-31 17:55:31 +00:00
|
|
|
#endif
|
2010-07-19 18:00:20 +00:00
|
|
|
{ &hf_netmon_802_11_phy_type, { "PHY type", "netmon_802_11.phy_type", FT_UINT32,
|
2012-03-06 16:58:09 +00:00
|
|
|
BASE_DEC, VALS(phy_type), 0x0, NULL, HFILL } },
|
2010-07-19 18:00:20 +00:00
|
|
|
{ &hf_netmon_802_11_channel, { "Channel", "netmon_802_11.channel", FT_UINT32,
|
2012-03-06 16:58:09 +00:00
|
|
|
BASE_DEC, NULL, 0x0, NULL, HFILL } },
|
2010-07-19 18:00:20 +00:00
|
|
|
{ &hf_netmon_802_11_frequency, { "Center frequency", "netmon_802_11.frequency", FT_UINT32,
|
2016-12-13 19:26:27 +00:00
|
|
|
BASE_DEC|BASE_UNIT_STRING, &units_mhz, 0x0, NULL, HFILL } },
|
2010-07-19 18:00:20 +00:00
|
|
|
{ &hf_netmon_802_11_rssi, { "RSSI", "netmon_802_11.rssi", FT_INT32,
|
2012-03-06 16:58:09 +00:00
|
|
|
BASE_DEC, NULL, 0x0, NULL, HFILL } },
|
2010-07-19 18:00:20 +00:00
|
|
|
{ &hf_netmon_802_11_datarate, { "Data rate", "netmon_802_11.datarate", FT_UINT32,
|
2012-03-06 16:58:09 +00:00
|
|
|
BASE_DEC, NULL, 0x0, NULL, HFILL } },
|
2010-07-19 18:00:20 +00:00
|
|
|
/*
|
|
|
|
* XXX - is this host, or MAC, time stamp?
|
|
|
|
* It might be a FILETIME.
|
|
|
|
*/
|
|
|
|
{ &hf_netmon_802_11_timestamp, { "Timestamp", "netmon_802_11.timestamp", FT_UINT64,
|
2012-03-06 16:58:09 +00:00
|
|
|
BASE_DEC, NULL, 0x0, NULL, HFILL } },
|
2010-07-19 18:00:20 +00:00
|
|
|
};
|
|
|
|
static gint *ett[] = {
|
|
|
|
&ett_netmon_802_11,
|
|
|
|
&ett_netmon_802_11_op_mode
|
|
|
|
};
|
|
|
|
|
|
|
|
proto_netmon_802_11 = proto_register_protocol("NetMon 802.11 capture header",
|
|
|
|
"NetMon 802.11",
|
|
|
|
"netmon_802_11");
|
|
|
|
proto_register_field_array(proto_netmon_802_11, hf, array_length(hf));
|
|
|
|
proto_register_subtree_array(ett, array_length(ett));
|
|
|
|
}
|
|
|
|
|
|
|
|
void
|
|
|
|
proto_reg_handoff_netmon_802_11(void)
|
|
|
|
{
|
|
|
|
dissector_handle_t netmon_802_11_handle;
|
|
|
|
|
2015-06-20 22:57:57 +00:00
|
|
|
/* handle for 802.11+radio information dissector */
|
2016-03-16 13:02:52 +00:00
|
|
|
ieee80211_radio_handle = find_dissector_add_dependency("wlan_radio", proto_netmon_802_11);
|
2015-12-09 03:49:44 +00:00
|
|
|
netmon_802_11_handle = create_dissector_handle(dissect_netmon_802_11,
|
2010-07-19 18:00:20 +00:00
|
|
|
proto_netmon_802_11);
|
2012-05-02 03:11:00 +00:00
|
|
|
dissector_add_uint("wtap_encap", WTAP_ENCAP_IEEE_802_11_NETMON, netmon_802_11_handle);
|
2010-07-19 18:00:20 +00:00
|
|
|
}
|
2014-09-29 18:07:49 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Editor modelines - http://www.wireshark.org/tools/modelines.html
|
|
|
|
*
|
|
|
|
* Local Variables:
|
|
|
|
* c-basic-offset: 2
|
|
|
|
* tab-width: 8
|
|
|
|
* indent-tabs-mode: nil
|
|
|
|
* End:
|
|
|
|
*
|
|
|
|
* ex: set shiftwidth=2 tabstop=8 expandtab:
|
|
|
|
* :indentSize=2:tabSize=8:noTabs=true:
|
|
|
|
*/
|