Wireshark-bugs: [Wireshark-bugs] [Bug 7134] New: Wireshark is unable to display the correct IEEE
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Tue, 17 Apr 2012 20:57:08 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7134

           Summary: Wireshark is unable to display the correct IEEE802.11
                    MCS data rates due to header definition is unsigned
                    8-bit integer
           Product: Wireshark
           Version: 1.7.x (Experimental)
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: Trivial
          Priority: Low
         Component: TShark
        AssignedTo: bugzilla-admin@xxxxxxxxxxxxx
        ReportedBy: colustang@xxxxxxxxx


Created attachment 8256
  --> https://bugs.wireshark.org/bugzilla/attachment.cgi?id=8256
patch to fix tshark/wireshark to support correct IEEE802.11 MCS data rates

Build Information:
wireshark 1.7.0 (SVN Rev 39768 from /trunk)

Copyright 1998-2011 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (32-bit) with GTK+ 2.22.1, with Cairo 1.10.2, with Pango 1.28.3, with
GLib 2.26.1, with WinPcap (version unknown), with libz 1.2.5, without POSIX
capabilities, with SMI 0.4.8, with c-ares 1.7.1, with Lua 5.1, without Python,
with GnuTLS 2.10.3, with Gcrypt 1.4.6, with MIT Kerberos, with GeoIP, with
PortAudio V19-devel (built Nov  8 2011), with AirPcap.

Running on 32-bit Windows 7 Service Pack 1, build 7601, with WinPcap version
4.1.2 (packet.dll version 4.1.0.2001), based on libpcap version 1.0 branch
1_0_rel0b (20091008), GnuTLS 2.10.3, Gcrypt 1.4.6, without AirPcap.

Built using Microsoft Visual C++ 9.0 build 21022
--
Wireshark/tshark is not able to display any captured 802.11 frame with data
rate info is higher than 121.5Mbps (mcs 6 at 40MHz no SGI) from omnipeek
capture file.

Here is the example of using tshark to display the omnipeek captured data file:

C:\Downloads>"\Program Files\Wireshark\tshark.exe" -r wireshark-airo
peek-decode.pkt -V | grep -i rate
    Data Rate: 2.0 Mb/s
    Data Rate: 2.0 Mb/s
    Data Rate: 117.0 Mb/s
    Data Rate: 115.0 Mb/s

In fact, the first two packet is supposed to be 130Mbps.  The hexdump of the
airopeek-formatted file is showing 0x0104 (260).

The problem is due to the ieee_802_11_phdr.data_rate is defined as guint8,
since this variable is counting number of 0.5Mbps units, any datarates which is
higher than 255Mbps would get wrapped up.  In the above example, only the lower
8bit value will be put into the ieee_802_11_phdr which is 0x04 and result in
the incorrect 2Mbps display.

There are 802.11n WLAN product is capable to transmit @450Mbps, we should fix
this data_rate from guint8 to guint16.

This issue is also affecting all 1.6.x and latest development branch.

Colus

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.