Ask Your Question
0

data rate formatting possible? [SOLVED]

asked 2022-04-13 15:41:39 +0000

ck42 gravatar image

updated 2022-04-14 12:25:30 +0000

I have added a custom column (Field: ppi.80211-common.rate). The rates show up as something like "24000" whereas the more commonly expected format would be "24 Mbps"

In the actual PPI -> 802.11-Common section, WS does list this as desired. "Rate: 24.0 Mbps"

But even selecting this entry and adding it as a new column continues to show the formatting as just "24000".

Is there a way to format this field to have it displayed as desired? (version 3.4.5)

edit retag flag offensive close merge delete

2 Answers

Sort by » oldest newest most voted
0

answered 2022-04-13 23:30:45 +0000

Chuckc gravatar image

updated 2022-04-13 23:32:47 +0000

Save the Lua script below to a file ending in .lua in the
Help->About Wireshark->Folders: Personal Lua Plugins folder.
Start Wireshark or if Wireshark is already running, do Analyze->Reload Lua Plugins. It creates a new field (my_ppi.rate) formatted like the field in the Packet Details.

-- my_ppi.lua
-- https://ask.wireshark.org/question/26798/data-rate-formatting-possible/
-- Grab and format fields as needed

-- Step 1 - document as you go. See header above and set_plugin_info().
local my_ppi_info =
{
    version = "1.0.0",
    author = "Chuck Craft",
    description = "Copy ppi.80211-common.rate with custom format",
}

set_plugin_info(my_ppi_info)

-- Step 2 - create a protocol to attach new fields to
local my_ppi_p = Proto.new("my_ppi","Custom formatted ppi fields")

-- Step 3 - add some field(s) to Step 2 protocol
local pf = { rate = ProtoField.string("my_ppi.rate", "ppi.80211-common.rate with units") }

my_ppi_p.fields = pf

-- Step 4 - grab existing field(s) that will have different output format
ppi_rate_f = Field.new("ppi.80211-common.rate")

-- Step 5 - create the postdissector function that will run on each frame/packet
function my_ppi_p.dissector(tvb,pinfo,root)
    local tree = nil

    finfo = ppi_rate_f()

    if not (finfo == nil) then
        if not tree then
            tree = root:add(my_ppi_p)
        end
        local field_data = string.format("%.1f Mbps", finfo() / 1000.0)
        tree:add(pf.rate, field_data)
    end
end

-- Step 6 - register the new protocol as a postdissector
register_postdissector(my_ppi_p)

edit flag offensive delete link more

Comments

Chuckc: That worked beautifully! Very much appreciated!!

ck42 gravatar imageck42 ( 2022-04-14 12:25:10 +0000 )edit

There are several closed Issues/Bugs related to data rate. I'm curious if you have found another one in this capture. Would it be possible to share it or even just a few frames that show the issue?

For others that come along, there is a shorter Lua solution in that a column can be modified:
editing columns (in this case it would be TX_RATE)
I guess the "pro" to it is that there are no extra fields in the Packet Details. And the "con" to it is there are no extra fields in the Packet Details so nothing to indicate that the column is being changed under the covers.

Chuckc gravatar imageChuckc ( 2022-04-14 15:19:59 +0000 )edit

Sure, feel free to share the supplied capture/link.

ck42 gravatar imageck42 ( 2022-04-14 17:15:35 +0000 )edit

Is that in one of the comments?

Chuckc gravatar imageChuckc ( 2022-04-14 17:26:39 +0000 )edit

Odd...I could've sworn I posted a link to the file earlier. In any case, here it is: capturefile

ck42 gravatar imageck42 ( 2022-04-14 17:42:53 +0000 )edit
0

answered 2022-04-13 19:49:14 +0000

Chuckc gravatar image

updated 2022-04-13 20:01:44 +0000

The “Packet List” Pane

Add a new (not custom) column with type "IEEE 802.11 TX rate". The format is 24.0 without the Mbps.

Looking at the code (packet-ppi.c) it seems the units should be there but its not.

    rate_kbps = rate_raw * 500;
    ti = proto_tree_add_uint_format(ftree, hf_80211_common_rate, tvb,
                                    ptvcursor_current_offset(csr), 2, rate_kbps, "Rate: %.1f Mbps",
                                    rate_kbps / 1000.0);
    if (rate_kbps == 0)
        proto_item_append_text(ti, " [invalid]");
    col_add_fstr(pinfo->cinfo, COL_TX_RATE, "%.1f Mbps", rate_kbps / 1000.0);

There is a sample capture on the Wireshark wiki:

File: http_PPI.cap

Description: 802.11n capture with PPI encapsulation containing HTTP data.

It looks like packet-ieee80211-radio.c or packet-ieee80211-radiotap.c comes along later and overwrites the column string without the units:

    col_add_fstr(pinfo->cinfo, COL_TX_RATE, "%.1f", data_rate);

Your other options would be to make your own fields with MATE or Lua.

Edit/Note: disabling protocol 802.11 Radio in the sample capture results in the TX Rate column having the format that was set in packet-ppi.c: 24.0 Mbps.

image description

edit flag offensive delete link more

Comments

Chuckc, appreciate the response.

I realize now that I forgot to include one bit of info - which explains why I can't utilize the first 'fix' you recommended (Add a new (not custom) column with type "IEEE 802.11 TX rate".)

(Can't upload files yet, not enough points, so will have to describe)

Under PPI -> 802.11 Common - I have a "Rate: 24.0 Mbps" entry

Under 802.11 radio information - I have a "Data rate: 13.0 Mb/s" entry (This is the value that is populated if I use the non-custom column "IEEE 802.11 TX rate")

The problem is with the actual data rate value specified for the "IEEE 802.11 TX rate" field. I'm not sure where this value comes from, but it's not the value I'm looking for (24 Mbps vs 13 Mb/s). I'm not sure why these ...(more)

ck42 gravatar imageck42 ( 2022-04-13 21:00:44 +0000 )edit

It would help if we can look at the same capture file. If you can share a pcap, stick it on a public file share (Dropbox, Onedrive, Google, ...) and update your question to include a link to the file.

(Disabling the protocol was just to show that the column gets written with a different format in later layers.)

Related? 5280 - radiotap data rate wrong for some rates

Chuckc gravatar imageChuckc ( 2022-04-13 21:16:31 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2022-04-13 15:41:39 +0000

Seen: 72 times

Last updated: Apr 14