Ethereal-users: Re: [Ethereal-users] Intepreting MAC time stamps in Prism monitoring headers.

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxx>
Date: Wed, 30 Mar 2005 23:43:50 -0800
Mahesh Krishnan wrote:

I read somewhere on the internet that the MAC time is the time when the packet
was seen by the network card. If that is true, How do I interpret the value
that is printed in Hex.

You ask whoever maintains the driver for the card what that particular card supplies as the "MAC time". I think the driver is just supplying whateve data the card supplies, and passing that up to the application.

The Prism header is, umm, woefully underspecified; there's no documentation for it that I know of.

The AVS header used to be documented, but it appears that Solomon Peachy's replaced his old Web site with his blog; I don't know where the AVS spec went.

The radiotap header is reasonably well documented in its header file:

	http://www.freebsd.org/cgi/cvsweb.cgi/src/sys/net80211/ieee80211_radiotap.h?rev=1.5&content-type=text/x-cvsweb-markup

	http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/net80211/ieee80211_radiotap.h?rev=1.10&content-type=text/x-cvsweb-markup

	http://www.openbsd.org/cgi-bin/cvsweb/src/sys/net80211/ieee80211_radiotap.h?rev=1.5&content-type=text/x-cvsweb-markup

(hopefully DragonFly BSD will adopt it as well, if they haven't done so already, and once the one other major remaining BSD changes IOKit to support 802.11 as a network interface type, rather than forcing 802.11 drivers to pretend their interfaces are Ethernet interfaces, it'll adopt it as well).

That header speaks of

 * IEEE80211_RADIOTAP_TSFT              u_int64_t       microseconds
 *
 *      Value in microseconds of the MAC's 64-bit 802.11 Time
 *      Synchronization Function timer when the first bit of the
 *      MPDU arrived at the MAC. For received frames, only.
 *

so that *MIGHT* be what the time in question is in the Prism headers, as the reference to it as an "802.11" Time Synchronizaton Function timer suggests that it's part of the 802.11 standard - but, at least from my quick reading of the 802.11 spec, there's no notion that it's an absolute time with a fixed reference point.