First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
0

Dissector: how to get wlan radiotap data from upper layers?

  • retag add tags

I am creating a custom dissector that filters a specific ethertype and dissects the encapsulated data:

custom_handle = create_dissector_handle(dissect_custom, proto_custom);
dissector_add_uint("ethertype", CUSTOM_PROTO_ETHERTYPE, custom_handle);

The dissector works, but among other information, I have a requirement to add the packet RSSI to the Info column. The RSSI is in the radiotap header, so the question is how can I get it?

I have tried the signal fields in the packet_info struct, like: gint8 rssi = pinfo->pseudo_header->ieee_802_11.signal_dbm;, but they are always zero (why?). I have also searched how to get data from upper layers, but I have not found any clear information either (replies to questions asking this always show a workaround to avoid doing it, so I suspect there is a good reason to avoid this approach).

After a lot of reading, I do not know if I have to create my own radiotap dissector variant and use the p_add_proto_data() function, or if I have to register a tap interface, or maybe I can somehow get the info from pinfo->rec, or if I have to somehow register the dissector at a lower level and manually call the dissectors for the intermediate levels... I am really confused, how can I get the radiotap info?

doragasu's avatar
1
doragasu
asked 2022-02-14 12:51:47 +0000
grahamb's avatar
23.8k
grahamb
updated 2022-02-14 13:33:09 +0000
edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

1 Answer

0

I have found that I can just add the RSSI as a new column in the packet view, and that should work. Unfortunately, I would like to get the RSSI from both antennas present in the device, and it seems this is not possible with this trick, so I still need to access data from upper layers. But for anyone just needing the better value, this should work.

doragasu's avatar
1
doragasu
answered 2022-02-15 07:46:39 +0000
edit flag offensive 0 remove flag delete link

Comments

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer