How does wireshark extract frame length from radiotap header and 802.11 MAC header?

asked Jul 9 '2

hyunhi2 gravatar image

updated Jul 9 '2

Hi. I'm writing my own code to extract WLAN duration of each WLAN packet over the air. For efficiency, I want to capture only the mac header of the packet with tcpdump and calculate the wlan duration. When I inspect the pcap file containing only the mac header via wireshark, the frame length is calculated correctly, but I cannot find any clue to extract the frame length. As far as I know the L-SIG from radiotap header is supposed to contain length information, but I cannot see the relationship to the frame length. How does wireshark extract frame length from radiotap header and 802.11 MAC header?

Thanks in advance.

Preview: (hide)

Comments

Have you looked at the inside of the pcap blocks: View->Reload as File Format/Capture ?
Is tcpdump writing the packet length and the snaplen?

Chuckc gravatar imageChuckc ( Jul 11 '2 )