Ethereal-users: Re: [Ethereal-users] Intepreting MAC time stamps in Prism monitoring headers.

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Wed, 30 Mar 2005 23:43:50 -0800
Mahesh Krishnan wrote:


I read somewhere on the internet that the MAC time is the time when the packet
was seen by the network card. If that is true, How do I interpret the value
that is printed in Hex.
You ask whoever maintains the driver for the card what that particular card supplies as the "MAC time". I think the driver is just supplying whateve data the card supplies, and passing that up to the application.
The Prism header is, umm, woefully underspecified; there's no documentation for it that I know of.
The AVS header used to be documented, but it appears that Solomon Peachy's replaced his old Web site with his blog; I don't know where the AVS spec went. 

The radiotap header is reasonably well documented in its header file:

	http://www.freebsd.org/cgi/cvsweb.cgi/src/sys/net80211/ieee80211_radiotap.h?rev=1.5&content-type=text/x-cvsweb-markup

	http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/net80211/ieee80211_radiotap.h?rev=1.10&content-type=text/x-cvsweb-markup

	http://www.openbsd.org/cgi-bin/cvsweb/src/sys/net80211/ieee80211_radiotap.h?rev=1.5&content-type=text/x-cvsweb-markup
(hopefully DragonFly BSD will adopt it as well, if they haven't done so already, and once the one other major remaining BSD changes IOKit to support 802.11 as a network interface type, rather than forcing 802.11 drivers to pretend their interfaces are Ethernet interfaces, it'll adopt it as well). 

That header speaks of

 * IEEE80211_RADIOTAP_TSFT              u_int64_t       microseconds
 *
 *      Value in microseconds of the MAC's 64-bit 802.11 Time
 *      Synchronization Function timer when the first bit of the
 *      MPDU arrived at the MAC. For received frames, only.
 *
so that *MIGHT* be what the time in question is in the Prism headers, as the reference to it as an "802.11" Time Synchronizaton Function timer suggests that it's part of the 802.11 standard - but, at least from my quick reading of the 802.11 spec, there's no notion that it's an absolute time with a fixed reference point.