On Apr 9, 2016, at 1:09 AM, Yang Luo <hsluoyb@xxxxxxxxx> wrote:
> However, most information of the radiotap header is zero like below. The most commonly seen TSFT field (I thought) is not there. Although I didn't implement some fields like "Rate" yet, but I still feel it's too blank?
> Maybe this is because the underlying network card driver doesn't implement so many 802.11 OOB data,
It could be:
https://social.technet.microsoft.com/Forums/en-US/624a6148-f8ed-4be0-819e-924ae3cd3dda/wifi-in-netmon-dealing-with-broken-monitor-mode-implementations-in-the-drivers?forum=netmon
Michael Berg of Tamosoft has also noted that the quality of the metadata supplied by Native Wi-Fi drivers for Windows... *varies*. (Unfortunately, I think that was in some tweets he posted, and Twitter makes it *really hard* to search - it seems not to find reply tweets, which I think his comments were.)
> One of my 802.11 packet's radiotap header is like this:
>
> --------------------------------------------------------
> Radiotap Header v0, Length 15
> Header revision: 0
> Header pad: 0
> Header length: 15
> Present flags
> Flags: 0x00
> Channel frequency: 0
If the channel frequency is 0, that probably means that it's not supplied, so don't provide a Channel field.
> Channel flags: 0x0000
> SSI Signal: -47 dBm
> --------------------------------------------------------
>
>
> The only field with non-zero values is SSI Signal.
> sometimes -46 dBm, sometimes -47 dBm, most times is also 0 dBm.
That might mean that it's not supplying a signal strength; it means "1 milliwatt", which seems to be a lot stronger than the signals I typically see, so it's probably not a valid value.