How does wireshark extract frame length from radiotap header and 802.11 MAC header?

frame.len
retag add tags

Hi. I'm writing my own code to extract WLAN duration of each WLAN packet over the air. For efficiency, I want to capture only the mac header of the packet with tcpdump and calculate the wlan duration. When I inspect the pcap file containing only the mac header via wireshark, the frame length is calculated correctly, but I cannot find any clue to extract the frame length. As far as I know the L-SIG from radiotap header is supposed to contain length information, but I cannot see the relationship to the frame length. How does wireshark extract frame length from radiotap header and 802.11 MAC header?

Thanks in advance.

hyunhi2

asked 2022-07-09 09:26:37 +0000, updated 2022-07-09 09:27:09 +0000

edit flag offensive 0 remove flag close merge delete

Comments

Have you looked at the inside of the pcap blocks: View->Reload as File Format/Capture ?
Is tcpdump writing the packet length and the snaplen?

Chuckc (2022-07-11 00:40:41 +0000) edit

add a comment see more comments

Be the first one to answer this question!

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

How does wireshark extract frame length from radiotap header and 802.11 MAC header? edit

Comments

Be the first one to answer this question!

How does wireshark extract frame length from radiotap header and 802.11 MAC header?