1

I have a pcap file containing 802.11 traffic. How can i learn from this pcap file what is the uptime of any Access Point? There is a field named TimeStamp, is this field important for me?

1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Feb 19 '18 at 5:51
3

The timestamp in a PCAP file is the time the traffic was observed by the capturing platform. It is meant to be wall-clock time to high accuracy. It is expected that not all platforms implement a high-accuracy wallclock time (eg, the platform may not run even NTP, let alone more accurate technologies). Furthermore it is convention that implementations which use some other zero-hour are permissible PCAP. For example, some of the scrubbers for sharing PCAP files will have the first packet be the zero-hour to avoid leaking the wallclock time the capture was done.

Deriving uptime from a PCAP requires knowledge of the access point, its configured protocols, and (in more complex deployments) the coverage strategy of the access point controller. A few minutes of no traffic may not imply that the access point is restarting, or it may, it all depends upon the details.

Moreover with radio systems a lack of traffic may indicate a failure to receive by the monitoring platform, not necessarily a failure to transmit by the access point. Someone may have been microwaving their lunch :-)

Using SNMP is a more typical approach to collecting device uptime. Device uptime can be retrieved using the SNMP variable sysUpTime. That has SNMP object ID iso(1).identified-organization(3).dod(6).internet(1).mgmt(2).mib-2(1).system(1).sysUpTime(3). It is a key variable and implemented on all platforms which claim SNMP compliance.

Edit

The poster of the question has clarified their question

i want to how airodump-ng calculates this uptime from beacon timestamp field

Within the 802.11 hardware is a 1MHz clock maintained in a 64-bit register. That register is initialised to zero when power is applied. Therefore the value of that clock's register is initially the uptime of the WLAN controller in microseconds.

When a Beacon frame or Probe Response frame is transmitted then the value of that clock's register is placed in the Timestamp field.

For a WLAN with a single access point your "aircrack-ng" program can print the Beacon frame's Timestamp field and claim the value is the uptime of the access point.

However, in a multiple access point system the highest value of the Timestamp in all the Beacons received by an access point is written back into that access point's 1MHz clock register. Using this technique all the access points converge on a common value of the 1MHz clock (well, within 25µs or so).

In the multiple access point case we can only say that an individual access point's Beacon Timestamp is the upper bound of the access point's uptime -- the actual uptime of any particular access point could be lower. In fact it's simple to imagine a scenario where there is no access point which has the uptime claimed by the Timestamp.

For more information Google "802.11 Timestamp Synchronization Function", which is the name of the algorithm I have outlined above. You can download the 802.11 specification for free from the IEEE website. You'll find the TSF explained in depth in that specification. There's a lot more depth, as you can imagine from Adhoc networks which have no access points, multiple-SSID access points, and so on.

2
  • Thanks for information. If you use airodump-ng there is an uptime field that displays Accsess point uptime. And there is an info in its website. "--uptime : Display AP Uptime from Beacon Timestamp" website is that aircrack-ng.org/doku.php?id=airodump-ng Actually i want to how airodump-ng calculates this uptime from beacon timestamp field
    – Pioneerhfy
    Jul 12 '17 at 7:25
  • Edited answer to address this clarification of the question.
    – vk5tu
    Jul 13 '17 at 12:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.