What is the difference between wlan.duration and wlan_radio.duration
what is the difference between wlan.duration and wlan_radio.duration?
wlan_radio.duration is a field calculated based on various radio and 802.11 information; to quote the description of the field, which may show up if you hover the mouse over the field in Wireshark:
Total duration of the aggregate in microseconds, including any preamble or plcp header. Calculated from the total subframe lengths, modulation and other phy data.
wlan.duration is the Duration/ID field from the 802.11 MAC header; to quote IEEE Std 802.11-2016:
The Duration/ID field is 16 bits in length. The contents of this field vary with frame type and subtype, with whether the frame is transmitted during the CFP, and with the QoS capabilities of the sending STA. The contents of the field are defined as follows:
a) In Control frames of subtype PS-Poll, the Duration/ID field carries the association identifier (AID) of the STA that transmitted the frame in the 14 least significant bits (LSB), and the 2 most significant bits (MSB) both set to 1.
b) In frames transmitted by the PC and non-QoS STAs, during the CFP, the Duration/ID field is set to a fixed value of 32 768.
c) In all other frames sent by non-QoS STAs and Control frames sent by QoS STAs, the Duration/ID field contains a duration value as defined for each frame type in 9.3.
d) In Data and Management frames sent by QoS STAs, the Duration/ID field contains a duration value as defined for each frame type in 9.2.5.
Please start posting anonymously - your entry will be published after you log in or create a new account.
Asked: 2018-12-09 00:06:24 +0000
Seen: 1,961 times
Last updated: Mar 24 '19
802.11 Sniffer Capture Analysis deauth packets with wireshark
Explanation for Difference in WLAN Captures
Huge amount of WiFi traffic until reconnect
Missing frames in Block Ack packet in wireless monitor-mode capture...
what is the capture/display filter to get RSSI information of WiFi users?
Trouble decryping WPA2 WLAN traffic in Wireshark
Why do Tshark gives two data_rate?