I don't mean simply the data format of these, as that is easy enough to look up. I am referring to what they actually mean, and the units and where they originate.

Looking at a script I have been tasked with amending, it appears radiotap.mactime is the transmission end time of a frame (from which the transmission start time can be determined by subtracting the frame length in octets divided by radiotap.datarate

Generally, are there any up-to-date references that describe all the Wireshark elements in fairly leisurely terms?

A page such as https://www.wireshark.org/docs/dfref/r/radiotap.html is of fairly limited use if one doesn't know what most of the values mean!



radiotap.mactime is the "value in microseconds of the MAC's 64-bit 802.11 Time Synchronization Function timer when the first bit of the MPDU arrived at the MAC". If it's the end time, whoever wrote the driver for the adapter on which the capture was done apparently didn't read the radiotap Web site's documentation for that field.

wlan_mgt.fixed.timestamp is the field described by section "Timestamp field" of IEEE Std 802.11-2012. The Time Synchronization Function is described in section 10.1 "Synchronization" in that document. Note that the TSF timer does NOT represent any particular absolute time, so you can't use it to, for example, determine the time and date at which some particular packet was transmitted or received.

There probably aren't any references of the sort you describe. Protocol specifications and tutorials don't generally talk about Wireshark (or any other particular network analyzer), so all you have to translate between a Wireshark field name and the field in the specification to which it corresponds is the field name and Wireshark blurb for the field, if it has a blurb.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.