Why is the wlan_radio.duration field not always shown?

asked 2021-05-29 16:41:03 +0000

Christian_R

2059 ●9 ●71 ●51 http://crnetpackets.com

updated 2021-05-29 21:55:58 +0000

Hello, why is the wlan_radio.duration not shown in the first packet of the trace example? Wireshark_QA copy.pcapng

BTW: Linkname and filename of the capture are different. Filename was automatically given by Wireshark Q&A

Update:

Build Info:

3.4.5 (v3.4.5-0-g7db1feb42ce9)

Compiled (64-bit) with Qt 5.12.6, with libpcap, without POSIX capabilities, with
GLib 2.58.3, with zlib 1.2.11, with SMI 0.4.8, with c-ares 1.15.0, with Lua
5.2.4, with GnuTLS 3.6.15 and PKCS #11 support, with Gcrypt 1.8.7, with MIT
Kerberos, with MaxMind DB resolver, with nghttp2 1.39.2, with brotli, with LZ4,
with Zstandard, with Snappy, with libxml2 2.9.9, with QtMultimedia, with
automatic updates using Sparkle, with SpeexDSP (using system library), with
Minizip.

Running on Mac OS X 10.15.7, build 19H1030 (Darwin 19.6.0), with Intel(R)
Core(TM) i7-8700B CPU @ 3.20GHz (with SSE4.2), with 32768 MB of physical memory,
with locale C, with dark display mode, without HiDPI, with libpcap version
1.9.1, with GnuTLS 3.6.15, with Gcrypt 1.8.7, with brotli 1.0.9, with zlib
1.2.11, binary plugins supported (21 loaded).

Built using clang 4.2.1 Compatible Apple LLVM 11.0.0 (clang-1100.0.33.16).

BR Christian

edit retag flag offensive close merge delete

Comments

In what version of Wireshark is it now shown? It shows up in the 3.4.5 release version.

Guy Harris ( 2021-05-29 18:49:44 +0000 )edit

@Guy Harris I have updated the question with the build info. Has it maybe something to do with 802.11n or 802.11ac?

Christian_R ( 2021-05-29 18:59:28 +0000 )edit

I have updated the question with the build info.

That's the same version I'm running.

Has it maybe something to do with 802.11n or 802.11ac?

Given that, as I said, I'm also running the macOS 3.4.5 build, and am seeing the wlan.duration field in both packets, it has nothing to do with either of them; if it had something to do with that, it'd affect all machines running that version of 3.4.5, and probably all machines running (unmodified) 3.4.5 on all platforms.

I.e., if I open up the "Frame Control Field", the first frame has "Duration: 48 microseconds" and the second frame has "Duration: 0 microseconds".

Note, however, that the name of the file you linked to is 16223064006424996.pcapng, NOT Wireshark_QA copy.pcapng. Are they the same file, or did you upload the wrong file?

Guy Harris ( 2021-05-29 19:42:05 +0000 )edit

add a comment

2 Answers

Sort by » oldest newest most voted

answered 2021-06-02 09:30:48 +0000

Guy Harris
19890 ●3 ●633 ●207

Only in 802.11ac

A quick look at the 3.4.x and main-branch code seems to indicate that if a frame manages to be identified as 11ac, the duration is always calculated. (Look for have_duration being set to TRUE.)

If somebody has an 11ac capture where the 802.11 radio information shows the PHY as 11ac:

PHY type: 802.11ac (VHT)

and there's no duration information, please file an issue on the Wireshark issue list and attach a capture file containing at least one frame where that's the case, so we can determine why that's happening.

Note that a routine used when calculating the duration for 11ac has a comment that says:

"NOTE: this is a crude quick hack, need proper calculation of bits/symbols/FEC/etc"

so the duration might not be as accurate as you might like.

For 11n, the code will not try to calculate the duration if:

the MCS index is not present in the radio metadata;
the bandwidth is not presnet in the radio metadata;
the "short GI" indication is not present in the radio metadata;
the data is invalid (meaning that values used as indices in various tables are out of the range for the table in question.

and maybe 802.11ax

There is currently no code to calculate the duration for 11ax, because nobody's written it.

edit flag offensive delete link

Comments

The problem was solved with closing of Issue17419. (Commit 5202119239)

Christian_R ( 2021-06-02 22:43:04 +0000 )edit

add a comment

answered 2021-05-29 20:35:25 +0000

Jim Young
196 ●16 ●4

updated 2021-05-29 20:36:07 +0000

The Duration field is a derived value. My experience with monitor mode captures created on my macOS systems is that the meta data used to calculate the Duration is occasionally missing on some packets. When I filter for !wlan_radio.duration these packets have a PHY type of 802.11ac (VHT). A quick survey of a handful of monitor mode pcaps with a display filter of wlan_radio.phy == 8 (802.11ac) shows that no Duration fields are generated.

edit flag offensive delete link

Comments

The Duration field is a derived value.

Which Duration field?

The person who asked the question mentioned wlan.duration, which is the Duration/ID field in the 802.11 header. It's described in section 9.2.4.2 "Duration/ID field" of IEEE 802.11-2016 as:

a) In Control frames of subtype PS-Poll, the Duration/ID field carries the association identifier (AID) of the STA that transmitted the frame in the 14 least significant bits (LSB), and the 2 most significant bits (MSB) both set to 1.
b) In frames transmitted by the PC and non-QoS STAs, during the CFP, the Duration/ID field is set to a fixed value of 32 768.
c) In all other frames sent by non-QoS STAs and Control frames sent by QoS STAs, the Duration/ID field contains a duration value as defined for each frame type in 9.3.
d) In Data ...

(more)

Guy Harris ( 2021-05-29 20:58:13 +0000 )edit

@Guy Harris: Oh I have to apologize for this big mistake. Of course I have meant wlan_radio.duration

@Jim Young: Good spot!

Christian_R ( 2021-05-29 21:50:50 +0000 )edit

@Jim Young: Is the field missing only with 802.11ac or also with 802.11n frames?

Christian_R ( 2021-05-31 17:04:47 +0000 )edit

Only in 802.11ac and maybe 802.11ax frames the wlan_radio.duration field does not show up. Is this an issue or is it wanted?

Christian_R ( 2021-06-02 09:05:46 +0000 )edit

Hi, I have created Issue17419

Christian_R ( 2021-06-02 12:52:55 +0000 )edit

see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Why is the wlan_radio.duration field not always shown?

Comments

2 Answers

Comments

Comments

Your Answer

Question Tools

Stats

Related questions

Why is the wlan_radio.duration field not always shown? edit

Comments

2 Answers

Comments

Comments

Your Answer

Question Tools

Stats

Related questions

Why is the wlan_radio.duration field not always shown?