Ethereal-dev: Re: [Ethereal-dev] Ethereal 0.9.16 doesn't read AiroPeek 2.0 files

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Martin Regner" <martin.regner@xxxxxxxxx>
Date: Tue, 25 Nov 2003 00:01:50 +0100
Martin Regner wrote:
>
> I found the following page with some observations about the new format.
>
> http://www.varsanofiev.com/inside/airopeekv9.htm
>

I made some own investigations based on his observations and I think that
the frame data means something like below.
However this is just very preliminar information based on a few sample
captures, some experiments and some guessing.

0x00 0x00   (Tag: Packet length)
   0x47 0x00 0x00 0x00   (64 octets)

0x01 0x00  (Tag: Timestamp LSB)
   0x68 0x3b 0x2e 0xec

0x02 0x00  (Tag: Timestamp MSB)
   0x11 0x46 0x5d 0xaf

0x03 0x00  (Tag: Flags and Status  - Not sure about exactly what the bit
mask means completely)
2 bytes for Flags and 2 bytes for Status

  0x02 0x00
      (FLAGS   0x02=>CRC Error, 0x04=>Frame Eror, 0x40=>Trigger, 0x06=0x04
OR 0x02=>CRC Error+Frame Error, ...)
                  0x02 0x00
                        (STATUS 0x02=>Truncated, 0x04=>Encrypted, 0x08=>
Decryption error, 0x40=> Short preamble)
Note: the value shown for FLAGS and STATUS shown in Airopeek doesn't always
correspond to the values stored in the file.

0x04 0x00  (Tag:  Channel number)
   0x0b 0x00 0x00 0x00     (Channel 11)

0x05 0x00  (Tag: Rate)
    0x02 0x00 0x00 0x00

0x06 0x00  (Tag: Signal level %)
    0x4a 0x00 0x00 0x00

0x07 0x00  (Tag: Signal level dBm)
   0x01 0x80 0xff 0xff

0x08 0x00  (Tag: Noise level %)
   0x00 0x00 0x00 0x00  (Setting the octets to 0x3d 0x00 0x00 0x00 and you
will get "Noise level: 61 %")

0x09 0x00 (Tag: Noise level dBm)
   0x01 0x80 0xff 0xff
(The value is not shown if it has this value, but if the value is 0xdd 0xff
0xff 0xff then you will see "Noise Level: -35 dBm")

0xff 0xff  (Tag: Slice length)
   0x47 0x00 0x00 0x00   This value is shown as "slice length" if less than
"packet length" (Status byte will then be ORed by 0x20 and you will see
"Sliced" for Status).

then followed by the packet slice data