SemFio Networks

  • Home
  • About
  • Services
    • Wi-Fi DevOps with Mist
  • Partners
    • Mist
  • Training
  • Contacts
  • Blog
  • Home
  • About
  • Services
    • Wi-Fi DevOps with Mist
  • Partners
    • Mist
  • Training
  • Contacts
  • Blog

Wireshark: How to check if a data frame is sent using 802.11n

4/14/2015

3 Comments

 
Studying for the CWAP exam, I was using Wireshark and wondering how to see if the traffic (data frames) I was capturing was using HT (or 802.11n). So this article will show you how to find out!

Let's start by talking about the Wi-Fi frames:
 - PPDU (PLCP Packet Data Unit) : This is the frame at the physical layer (Layer 1 of the OSI Model).
 - MPDU (Mac Protocol Data Unit) : This is the frame at the Data-Link layer (Layer 2 of the OSI Model).

The MPDU is encapsulated into the PPDU as shown in the drawing below (taken from the CWAP study guide):
Picture
There is 3 formats of PPDU introduced with the 802.11n technology (see image below taken from the CWAP study guide):
 - non-HT Legacy: used with non 802.11n clients
 - HT Mixed: used for both 802.11n and non 802.11n clients
 - HT Greenfield: used and understood only by 802.11n clients
Picture
Looking at the name of these PPDUs, you can easily understand that if we could see them, we could determine if the frame is using 802.11n or not. However, it is not that simple. Since, these preambles are present at the Layer 1, they are trimmed by the NIC before reaching Wireshark.

However, Wireshark is still able to tell you if the frame is sent with 802.11n. Here is where to find it:
 - Filter data frames using the following filter: "wlan.fc.type==2"
 - Click on the frame you want to check
 - Open the "Radiotap Header" tab in the packet detail view
So how does Wireshark do it? It uses a combination of information available to him from the RadioTap Header. This RadioTap Header is added in from of the MPDU by the Wireless NIC when capturing frames. (For more information on the RadioTap Header, read this great article written by Nigel Bowden). Wireshark uses the following information from this RadioTap Header:
  • Type of modulation (OFDM in our case)
  • Frequency Band (5GHz in our case)
  • Channel width (40MHz in our case)

However, some data frames, like the "Null function" frames, are not sent with 40MHz width channels even if the network is configured that way. Therefore, Wireshark does not see these frames as 802.11n frames. Instead (because of the OFDM modulation and the use of the 5GHz band), Wireshark tags these frames as being 802.11a frames:
Picture
So looking at the RadioTap Header, Wireshark can have a good idea of the Wi-Fi technology used to transmit the frame. If you want to double check what technologies are supported for a specific SSID, the best is to have a look at the beacon frame (which is a management frame). To filter beacon frames in Wireshark, use the following filter: "wlan.fc.type==0 && wlan.fc.subtype==8".

Cheers'


Written by François Vergès

Source: CWAP Study Guide by CWNP
3 Comments
    Picture

    François Vergès

    François Vergès is the founder of SemFio Networks. As a Network Engineer, he has a real passion for Wi-Fi.

    Picture Picture Picture

    Categories

    All
    5G
    5GHz
    6GHz
    802.11
    802.11ax
    802.11v
    802.1X
    AirConsole
    Aruba
    ArubaOS
    AutoCAD
    Automation
    Brand
    Capture
    Cisco
    Cisco WLC
    CLI
    Cloud
    Co-Channel Contention
    Controller Upgrade
    Course
    CWNE
    CWNP
    Design
    DFS
    Diagrams
    Ekahau
    FreeRADIUS
    Frequencies
    FSPL
    Hotspot
    Ideas
    Industry Canada
    Interference
    ISED
    Jetson Nano
    KRACK
    London
    MagicQuadrant
    MakeWi FiVisible
    MakeWi-FiVisible
    Market
    Meetup
    Mobility Express
    News
    Packet Analysis
    Programming
    Python
    Reference Guide
    Script
    Security
    SemFio
    Site-survey
    Site-survey
    Spectrum-analysis
    Technology
    Timeline
    Tip
    Training
    Validation
    Video
    Warehouse
    WiFi
    Wi-FI
    Wi-Fi
    Wi Fi 6
    Wi-Fi 6
    Wifitraining
    Wi Fi Troubleshooting
    Wi-Fi Troubleshooting
    Wireshark
    WLAN Pi
    WLPC
    WPA2

    Archives

    July 2020
    March 2020
    February 2020
    January 2020
    December 2019
    October 2019
    August 2019
    July 2019
    June 2019
    April 2019
    January 2019
    December 2018
    November 2018
    August 2018
    May 2018
    April 2018
    March 2018
    January 2018
    December 2017
    November 2017
    October 2017
    September 2017
    May 2017
    April 2017
    February 2017
    January 2017
    November 2016
    September 2016
    August 2016
    May 2016
    April 2016
    March 2016
    February 2016
    December 2015
    November 2015
    September 2015
    August 2015
    July 2015
    April 2015
    February 2015
    January 2015
    December 2014
    November 2014
    October 2014
    September 2014
    August 2014
    June 2014
    May 2014

    RSS Feed

SemFioNetworks-EmailContact SemFioNetworks-LinkedInProfile SemFioNetworks-YoutubeChannel

Let's Talk

Please get in touch with us if you have any questions. We offer a wide variety of professional Wi-Fi services that can help your wireless environment becoming faster, more secure and more efficient!
Get in touch
SemFioNetworks-Logo
Copyright © 2020 by SemFio Networks Inc.