How does wireshark extract frame length from radiotap header and 802.11 MAC header?

asked 2022-07-09 09:26:37 +0000

hyunhi2 gravatar image

updated 2022-07-09 09:27:09 +0000

Hi. I'm writing my own code to extract WLAN duration of each WLAN packet over the air. For efficiency, I want to capture only the mac header of the packet with tcpdump and calculate the wlan duration. When I inspect the pcap file containing only the mac header via wireshark, the frame length is calculated correctly, but I cannot find any clue to extract the frame length. As far as I know the L-SIG from radiotap header is supposed to contain length information, but I cannot see the relationship to the frame length. How does wireshark extract frame length from radiotap header and 802.11 MAC header?

Thanks in advance.

edit retag flag offensive close merge delete

Comments

Have you looked at the inside of the pcap blocks: View->Reload as File Format/Capture ?
Is tcpdump writing the packet length and the snaplen?

Chuckc gravatar imageChuckc ( 2022-07-11 00:40:41 +0000 )edit
add a comment