]> The Tcpdump Group git mirrors - tcpdump/blob - print-802_11.c
projects / tcpdump / blob
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
DCCP tests: more verbosity (from -v to -vv)
[tcpdump] / print-802_11.c
1 /*
2 * Copyright (c) 2001
3 * Fortress Technologies, Inc. All rights reserved.
4 * Charlie Lenahan (clenahan@fortresstech.com)
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that: (1) source code distributions
8 * retain the above copyright notice and this paragraph in its entirety, (2)
9 * distributions including binary code include the above copyright notice and
10 * this paragraph in its entirety in the documentation or other materials
11 * provided with the distribution, and (3) all advertising materials mentioning
12 * features or use of this software display the following acknowledgement:
13 * ``This product includes software developed by the University of California,
14 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
15 * the University nor the names of its contributors may be used to endorse
16 * or promote products derived from this software without specific prior
17 * written permission.
18 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
19 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
20 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
21 */
22
23 #ifdef HAVE_CONFIG_H
24 #include "config.h"
25 #endif
26
27 #include <tcpdump-stdinc.h>
28
29 #include <stdio.h>
30 #include <pcap.h>
31 #include <string.h>
32
33 #include "interface.h"
34 #include "addrtoname.h"
35 #include "ethertype.h"
36
37 #include "extract.h"
38
39 #include "cpack.h"
40
41
42 /* Lengths of 802.11 header components. */
43 #define IEEE802_11_FC_LEN 2
44 #define IEEE802_11_DUR_LEN 2
45 #define IEEE802_11_DA_LEN 6
46 #define IEEE802_11_SA_LEN 6
47 #define IEEE802_11_BSSID_LEN 6
48 #define IEEE802_11_RA_LEN 6
49 #define IEEE802_11_TA_LEN 6
50 #define IEEE802_11_SEQ_LEN 2
51 #define IEEE802_11_CTL_LEN 2
52 #define IEEE802_11_IV_LEN 3
53 #define IEEE802_11_KID_LEN 1
54
55 /* Frame check sequence length. */
56 #define IEEE802_11_FCS_LEN 4
57
58 /* Lengths of beacon components. */
59 #define IEEE802_11_TSTAMP_LEN 8
60 #define IEEE802_11_BCNINT_LEN 2
61 #define IEEE802_11_CAPINFO_LEN 2
62 #define IEEE802_11_LISTENINT_LEN 2
63
64 #define IEEE802_11_AID_LEN 2
65 #define IEEE802_11_STATUS_LEN 2
66 #define IEEE802_11_REASON_LEN 2
67
68 /* Length of previous AP in reassocation frame */
69 #define IEEE802_11_AP_LEN 6
70
71 #define T_MGMT 0x0 /* management */
72 #define T_CTRL 0x1 /* control */
73 #define T_DATA 0x2 /* data */
74 #define T_RESV 0x3 /* reserved */
75
76 #define ST_ASSOC_REQUEST 0x0
77 #define ST_ASSOC_RESPONSE 0x1
78 #define ST_REASSOC_REQUEST 0x2
79 #define ST_REASSOC_RESPONSE 0x3
80 #define ST_PROBE_REQUEST 0x4
81 #define ST_PROBE_RESPONSE 0x5
82 /* RESERVED 0x6 */
83 /* RESERVED 0x7 */
84 #define ST_BEACON 0x8
85 #define ST_ATIM 0x9
86 #define ST_DISASSOC 0xA
87 #define ST_AUTH 0xB
88 #define ST_DEAUTH 0xC
89 #define ST_ACTION 0xD
90 /* RESERVED 0xE */
91 /* RESERVED 0xF */
92
93
94 #define CTRL_CONTROL_WRAPPER 0x7
95 #define CTRL_BAR 0x8
96 #define CTRL_BA 0x9
97 #define CTRL_PS_POLL 0xA
98 #define CTRL_RTS 0xB
99 #define CTRL_CTS 0xC
100 #define CTRL_ACK 0xD
101 #define CTRL_CF_END 0xE
102 #define CTRL_END_ACK 0xF
103
104 #define DATA_DATA 0x0
105 #define DATA_DATA_CF_ACK 0x1
106 #define DATA_DATA_CF_POLL 0x2
107 #define DATA_DATA_CF_ACK_POLL 0x3
108 #define DATA_NODATA 0x4
109 #define DATA_NODATA_CF_ACK 0x5
110 #define DATA_NODATA_CF_POLL 0x6
111 #define DATA_NODATA_CF_ACK_POLL 0x7
112
113 #define DATA_QOS_DATA 0x8
114 #define DATA_QOS_DATA_CF_ACK 0x9
115 #define DATA_QOS_DATA_CF_POLL 0xA
116 #define DATA_QOS_DATA_CF_ACK_POLL 0xB
117 #define DATA_QOS_NODATA 0xC
118 #define DATA_QOS_CF_POLL_NODATA 0xE
119 #define DATA_QOS_CF_ACK_POLL_NODATA 0xF
120
121 /*
122 * The subtype field of a data frame is, in effect, composed of 4 flag
123 * bits - CF-Ack, CF-Poll, Null (means the frame doesn't actually have
124 * any data), and QoS.
125 */
126 #define DATA_FRAME_IS_CF_ACK(x) ((x) & 0x01)
127 #define DATA_FRAME_IS_CF_POLL(x) ((x) & 0x02)
128 #define DATA_FRAME_IS_NULL(x) ((x) & 0x04)
129 #define DATA_FRAME_IS_QOS(x) ((x) & 0x08)
130
131 /*
132 * Bits in the frame control field.
133 */
134 #define FC_VERSION(fc) ((fc) & 0x3)
135 #define FC_TYPE(fc) (((fc) >> 2) & 0x3)
136 #define FC_SUBTYPE(fc) (((fc) >> 4) & 0xF)
137 #define FC_TO_DS(fc) ((fc) & 0x0100)
138 #define FC_FROM_DS(fc) ((fc) & 0x0200)
139 #define FC_MORE_FLAG(fc) ((fc) & 0x0400)
140 #define FC_RETRY(fc) ((fc) & 0x0800)
141 #define FC_POWER_MGMT(fc) ((fc) & 0x1000)
142 #define FC_MORE_DATA(fc) ((fc) & 0x2000)
143 #define FC_WEP(fc) ((fc) & 0x4000)
144 #define FC_ORDER(fc) ((fc) & 0x8000)
145
146 struct mgmt_header_t {
147 u_int16_t fc;
148 u_int16_t duration;
149 u_int8_t da[6];
150 u_int8_t sa[6];
151 u_int8_t bssid[6];
152 u_int16_t seq_ctrl;
153 };
154
155 #define MGMT_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_DUR_LEN+\
156 IEEE802_11_DA_LEN+IEEE802_11_SA_LEN+\
157 IEEE802_11_BSSID_LEN+IEEE802_11_SEQ_LEN)
158
159 #define CAPABILITY_ESS(cap) ((cap) & 0x0001)
160 #define CAPABILITY_IBSS(cap) ((cap) & 0x0002)
161 #define CAPABILITY_CFP(cap) ((cap) & 0x0004)
162 #define CAPABILITY_CFP_REQ(cap) ((cap) & 0x0008)
163 #define CAPABILITY_PRIVACY(cap) ((cap) & 0x0010)
164
165 struct ssid_t {
166 u_int8_t element_id;
167 u_int8_t length;
168 u_char ssid[33]; /* 32 + 1 for null */
169 };
170
171 struct rates_t {
172 u_int8_t element_id;
173 u_int8_t length;
174 u_int8_t rate[16];
175 };
176
177 struct challenge_t {
178 u_int8_t element_id;
179 u_int8_t length;
180 u_int8_t text[254]; /* 1-253 + 1 for null */
181 };
182
183 struct fh_t {
184 u_int8_t element_id;
185 u_int8_t length;
186 u_int16_t dwell_time;
187 u_int8_t hop_set;
188 u_int8_t hop_pattern;
189 u_int8_t hop_index;
190 };
191
192 struct ds_t {
193 u_int8_t element_id;
194 u_int8_t length;
195 u_int8_t channel;
196 };
197
198 struct cf_t {
199 u_int8_t element_id;
200 u_int8_t length;
201 u_int8_t count;
202 u_int8_t period;
203 u_int16_t max_duration;
204 u_int16_t dur_remaing;
205 };
206
207 struct tim_t {
208 u_int8_t element_id;
209 u_int8_t length;
210 u_int8_t count;
211 u_int8_t period;
212 u_int8_t bitmap_control;
213 u_int8_t bitmap[251];
214 };
215
216 #define E_SSID 0
217 #define E_RATES 1
218 #define E_FH 2
219 #define E_DS 3
220 #define E_CF 4
221 #define E_TIM 5
222 #define E_IBSS 6
223 /* reserved 7 */
224 /* reserved 8 */
225 /* reserved 9 */
226 /* reserved 10 */
227 /* reserved 11 */
228 /* reserved 12 */
229 /* reserved 13 */
230 /* reserved 14 */
231 /* reserved 15 */
232 /* reserved 16 */
233
234 #define E_CHALLENGE 16
235 /* reserved 17 */
236 /* reserved 18 */
237 /* reserved 19 */
238 /* reserved 16 */
239 /* reserved 16 */
240
241
242 struct mgmt_body_t {
243 u_int8_t timestamp[IEEE802_11_TSTAMP_LEN];
244 u_int16_t beacon_interval;
245 u_int16_t listen_interval;
246 u_int16_t status_code;
247 u_int16_t aid;
248 u_char ap[IEEE802_11_AP_LEN];
249 u_int16_t reason_code;
250 u_int16_t auth_alg;
251 u_int16_t auth_trans_seq_num;
252 int challenge_present;
253 struct challenge_t challenge;
254 u_int16_t capability_info;
255 int ssid_present;
256 struct ssid_t ssid;
257 int rates_present;
258 struct rates_t rates;
259 int ds_present;
260 struct ds_t ds;
261 int cf_present;
262 struct cf_t cf;
263 int fh_present;
264 struct fh_t fh;
265 int tim_present;
266 struct tim_t tim;
267 };
268
269 struct ctrl_rts_t {
270 u_int16_t fc;
271 u_int16_t duration;
272 u_int8_t ra[6];
273 u_int8_t ta[6];
274 u_int8_t fcs[4];
275 };
276
277 #define CTRL_RTS_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_DUR_LEN+\
278 IEEE802_11_RA_LEN+IEEE802_11_TA_LEN)
279
280 struct ctrl_cts_t {
281 u_int16_t fc;
282 u_int16_t duration;
283 u_int8_t ra[6];
284 u_int8_t fcs[4];
285 };
286
287 #define CTRL_CTS_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_DUR_LEN+IEEE802_11_RA_LEN)
288
289 struct ctrl_ack_t {
290 u_int16_t fc;
291 u_int16_t duration;
292 u_int8_t ra[6];
293 u_int8_t fcs[4];
294 };
295
296 #define CTRL_ACK_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_DUR_LEN+IEEE802_11_RA_LEN)
297
298 struct ctrl_ps_poll_t {
299 u_int16_t fc;
300 u_int16_t aid;
301 u_int8_t bssid[6];
302 u_int8_t ta[6];
303 u_int8_t fcs[4];
304 };
305
306 #define CTRL_PS_POLL_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_AID_LEN+\
307 IEEE802_11_BSSID_LEN+IEEE802_11_TA_LEN)
308
309 struct ctrl_end_t {
310 u_int16_t fc;
311 u_int16_t duration;
312 u_int8_t ra[6];
313 u_int8_t bssid[6];
314 u_int8_t fcs[4];
315 };
316
317 #define CTRL_END_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_DUR_LEN+\
318 IEEE802_11_RA_LEN+IEEE802_11_BSSID_LEN)
319
320 struct ctrl_end_ack_t {
321 u_int16_t fc;
322 u_int16_t duration;
323 u_int8_t ra[6];
324 u_int8_t bssid[6];
325 u_int8_t fcs[4];
326 };
327
328 #define CTRL_END_ACK_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_DUR_LEN+\
329 IEEE802_11_RA_LEN+IEEE802_11_BSSID_LEN)
330
331 struct ctrl_ba_t {
332 u_int16_t fc;
333 u_int16_t duration;
334 u_int8_t ra[6];
335 u_int8_t fcs[4];
336 };
337
338 #define CTRL_BA_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_DUR_LEN+IEEE802_11_RA_LEN)
339
340 struct ctrl_bar_t {
341 u_int16_t fc;
342 u_int16_t dur;
343 u_int8_t ra[6];
344 u_int8_t ta[6];
345 u_int16_t ctl;
346 u_int16_t seq;
347 u_int8_t fcs[4];
348 };
349
350 #define CTRL_BAR_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_DUR_LEN+\
351 IEEE802_11_RA_LEN+IEEE802_11_TA_LEN+\
352 IEEE802_11_CTL_LEN+IEEE802_11_SEQ_LEN)
353
354 struct meshcntl_t {
355 u_int8_t flags;
356 u_int8_t ttl;
357 u_int8_t seq[4];
358 u_int8_t addr4[6];
359 u_int8_t addr5[6];
360 u_int8_t addr6[6];
361 };
362
363 #define IV_IV(iv) ((iv) & 0xFFFFFF)
364 #define IV_PAD(iv) (((iv) >> 24) & 0x3F)
365 #define IV_KEYID(iv) (((iv) >> 30) & 0x03)
366
367 /* $FreeBSD: src/sys/net80211/ieee80211_radiotap.h,v 1.5 2005/01/22 20:12:05 sam Exp $ */
368 /* NetBSD: ieee802_11_radio.h,v 1.2 2006/02/26 03:04:03 dyoung Exp */
369
370 /*-
371 * Copyright (c) 2003, 2004 David Young. All rights reserved.
372 *
373 * Redistribution and use in source and binary forms, with or without
374 * modification, are permitted provided that the following conditions
375 * are met:
376 * 1. Redistributions of source code must retain the above copyright
377 * notice, this list of conditions and the following disclaimer.
378 * 2. Redistributions in binary form must reproduce the above copyright
379 * notice, this list of conditions and the following disclaimer in the
380 * documentation and/or other materials provided with the distribution.
381 * 3. The name of David Young may not be used to endorse or promote
382 * products derived from this software without specific prior
383 * written permission.
384 *
385 * THIS SOFTWARE IS PROVIDED BY DAVID YOUNG ``AS IS'' AND ANY
386 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
387 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
388 * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL DAVID
389 * YOUNG BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
390 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
391 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
392 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
393 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
394 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
395 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
396 * OF SUCH DAMAGE.
397 */
398
399 /* A generic radio capture format is desirable. It must be
400 * rigidly defined (e.g., units for fields should be given),
401 * and easily extensible.
402 *
403 * The following is an extensible radio capture format. It is
404 * based on a bitmap indicating which fields are present.
405 *
406 * I am trying to describe precisely what the application programmer
407 * should expect in the following, and for that reason I tell the
408 * units and origin of each measurement (where it applies), or else I
409 * use sufficiently weaselly language ("is a monotonically nondecreasing
410 * function of...") that I cannot set false expectations for lawyerly
411 * readers.
412 */
413
414 /*
415 * The radio capture header precedes the 802.11 header.
416 *
417 * Note well: all radiotap fields are little-endian.
418 */
419 struct ieee80211_radiotap_header {
420 u_int8_t it_version; /* Version 0. Only increases
421 * for drastic changes,
422 * introduction of compatible
423 * new fields does not count.
424 */
425 u_int8_t it_pad;
426 u_int16_t it_len; /* length of the whole
427 * header in bytes, including
428 * it_version, it_pad,
429 * it_len, and data fields.
430 */
431 u_int32_t it_present; /* A bitmap telling which
432 * fields are present. Set bit 31
433 * (0x80000000) to extend the
434 * bitmap by another 32 bits.
435 * Additional extensions are made
436 * by setting bit 31.
437 */
438 };
439
440 /* Name Data type Units
441 * ---- --------- -----
442 *
443 * IEEE80211_RADIOTAP_TSFT u_int64_t microseconds
444 *
445 * Value in microseconds of the MAC's 64-bit 802.11 Time
446 * Synchronization Function timer when the first bit of the
447 * MPDU arrived at the MAC. For received frames, only.
448 *
449 * IEEE80211_RADIOTAP_CHANNEL 2 x u_int16_t MHz, bitmap
450 *
451 * Tx/Rx frequency in MHz, followed by flags (see below).
452 * Note that IEEE80211_RADIOTAP_XCHANNEL must be used to
453 * represent an HT channel as there is not enough room in
454 * the flags word.
455 *
456 * IEEE80211_RADIOTAP_FHSS u_int16_t see below
457 *
458 * For frequency-hopping radios, the hop set (first byte)
459 * and pattern (second byte).
460 *
461 * IEEE80211_RADIOTAP_RATE u_int8_t 500kb/s or index
462 *
463 * Tx/Rx data rate. If bit 0x80 is set then it represents an
464 * an MCS index and not an IEEE rate.
465 *
466 * IEEE80211_RADIOTAP_DBM_ANTSIGNAL int8_t decibels from
467 * one milliwatt (dBm)
468 *
469 * RF signal power at the antenna, decibel difference from
470 * one milliwatt.
471 *
472 * IEEE80211_RADIOTAP_DBM_ANTNOISE int8_t decibels from
473 * one milliwatt (dBm)
474 *
475 * RF noise power at the antenna, decibel difference from one
476 * milliwatt.
477 *
478 * IEEE80211_RADIOTAP_DB_ANTSIGNAL u_int8_t decibel (dB)
479 *
480 * RF signal power at the antenna, decibel difference from an
481 * arbitrary, fixed reference.
482 *
483 * IEEE80211_RADIOTAP_DB_ANTNOISE u_int8_t decibel (dB)
484 *
485 * RF noise power at the antenna, decibel difference from an
486 * arbitrary, fixed reference point.
487 *
488 * IEEE80211_RADIOTAP_LOCK_QUALITY u_int16_t unitless
489 *
490 * Quality of Barker code lock. Unitless. Monotonically
491 * nondecreasing with "better" lock strength. Called "Signal
492 * Quality" in datasheets. (Is there a standard way to measure
493 * this?)
494 *
495 * IEEE80211_RADIOTAP_TX_ATTENUATION u_int16_t unitless
496 *
497 * Transmit power expressed as unitless distance from max
498 * power set at factory calibration. 0 is max power.
499 * Monotonically nondecreasing with lower power levels.
500 *
501 * IEEE80211_RADIOTAP_DB_TX_ATTENUATION u_int16_t decibels (dB)
502 *
503 * Transmit power expressed as decibel distance from max power
504 * set at factory calibration. 0 is max power. Monotonically
505 * nondecreasing with lower power levels.
506 *
507 * IEEE80211_RADIOTAP_DBM_TX_POWER int8_t decibels from
508 * one milliwatt (dBm)
509 *
510 * Transmit power expressed as dBm (decibels from a 1 milliwatt
511 * reference). This is the absolute power level measured at
512 * the antenna port.
513 *
514 * IEEE80211_RADIOTAP_FLAGS u_int8_t bitmap
515 *
516 * Properties of transmitted and received frames. See flags
517 * defined below.
518 *
519 * IEEE80211_RADIOTAP_ANTENNA u_int8_t antenna index
520 *
521 * Unitless indication of the Rx/Tx antenna for this packet.
522 * The first antenna is antenna 0.
523 *
524 * IEEE80211_RADIOTAP_RX_FLAGS u_int16_t bitmap
525 *
526 * Properties of received frames. See flags defined below.
527 *
528 * IEEE80211_RADIOTAP_XCHANNEL u_int32_t bitmap
529 * u_int16_t MHz
530 * u_int8_t channel number
531 * u_int8_t .5 dBm
532 *
533 * Extended channel specification: flags (see below) followed by
534 * frequency in MHz, the corresponding IEEE channel number, and
535 * finally the maximum regulatory transmit power cap in .5 dBm
536 * units. This property supersedes IEEE80211_RADIOTAP_CHANNEL
537 * and only one of the two should be present.
538 *
539 * IEEE80211_RADIOTAP_MCS u_int8_t known
540 * u_int8_t flags
541 * u_int8_t mcs
542 *
543 * Bitset indicating which fields have known values, followed
544 * by bitset of flag values, followed by the MCS rate index as
545 * in IEEE 802.11n.
546 *
547 * IEEE80211_RADIOTAP_VENDOR_NAMESPACE
548 * u_int8_t OUI[3]
549 * u_int8_t subspace
550 * u_int16_t length
551 *
552 * The Vendor Namespace Field contains three sub-fields. The first
553 * sub-field is 3 bytes long. It contains the vendor's IEEE 802
554 * Organizationally Unique Identifier (OUI). The fourth byte is a
555 * vendor-specific "namespace selector."
556 *
557 */
558 enum ieee80211_radiotap_type {
559 IEEE80211_RADIOTAP_TSFT = 0,
560 IEEE80211_RADIOTAP_FLAGS = 1,
561 IEEE80211_RADIOTAP_RATE = 2,
562 IEEE80211_RADIOTAP_CHANNEL = 3,
563 IEEE80211_RADIOTAP_FHSS = 4,
564 IEEE80211_RADIOTAP_DBM_ANTSIGNAL = 5,
565 IEEE80211_RADIOTAP_DBM_ANTNOISE = 6,
566 IEEE80211_RADIOTAP_LOCK_QUALITY = 7,
567 IEEE80211_RADIOTAP_TX_ATTENUATION = 8,
568 IEEE80211_RADIOTAP_DB_TX_ATTENUATION = 9,
569 IEEE80211_RADIOTAP_DBM_TX_POWER = 10,
570 IEEE80211_RADIOTAP_ANTENNA = 11,
571 IEEE80211_RADIOTAP_DB_ANTSIGNAL = 12,
572 IEEE80211_RADIOTAP_DB_ANTNOISE = 13,
573 IEEE80211_RADIOTAP_RX_FLAGS = 14,
574 /* NB: gap for netbsd definitions */
575 IEEE80211_RADIOTAP_XCHANNEL = 18,
576 IEEE80211_RADIOTAP_MCS = 19,
577 IEEE80211_RADIOTAP_NAMESPACE = 29,
578 IEEE80211_RADIOTAP_VENDOR_NAMESPACE = 30,
579 IEEE80211_RADIOTAP_EXT = 31
580 };
581
582 /* channel attributes */
583 #define IEEE80211_CHAN_TURBO 0x00010 /* Turbo channel */
584 #define IEEE80211_CHAN_CCK 0x00020 /* CCK channel */
585 #define IEEE80211_CHAN_OFDM 0x00040 /* OFDM channel */
586 #define IEEE80211_CHAN_2GHZ 0x00080 /* 2 GHz spectrum channel. */
587 #define IEEE80211_CHAN_5GHZ 0x00100 /* 5 GHz spectrum channel */
588 #define IEEE80211_CHAN_PASSIVE 0x00200 /* Only passive scan allowed */
589 #define IEEE80211_CHAN_DYN 0x00400 /* Dynamic CCK-OFDM channel */
590 #define IEEE80211_CHAN_GFSK 0x00800 /* GFSK channel (FHSS PHY) */
591 #define IEEE80211_CHAN_GSM 0x01000 /* 900 MHz spectrum channel */
592 #define IEEE80211_CHAN_STURBO 0x02000 /* 11a static turbo channel only */
593 #define IEEE80211_CHAN_HALF 0x04000 /* Half rate channel */
594 #define IEEE80211_CHAN_QUARTER 0x08000 /* Quarter rate channel */
595 #define IEEE80211_CHAN_HT20 0x10000 /* HT 20 channel */
596 #define IEEE80211_CHAN_HT40U 0x20000 /* HT 40 channel w/ ext above */
597 #define IEEE80211_CHAN_HT40D 0x40000 /* HT 40 channel w/ ext below */
598
599 /* Useful combinations of channel characteristics, borrowed from Ethereal */
600 #define IEEE80211_CHAN_A \
601 (IEEE80211_CHAN_5GHZ | IEEE80211_CHAN_OFDM)
602 #define IEEE80211_CHAN_B \
603 (IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_CCK)
604 #define IEEE80211_CHAN_G \
605 (IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_DYN)
606 #define IEEE80211_CHAN_TA \
607 (IEEE80211_CHAN_5GHZ | IEEE80211_CHAN_OFDM | IEEE80211_CHAN_TURBO)
608 #define IEEE80211_CHAN_TG \
609 (IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_DYN | IEEE80211_CHAN_TURBO)
610
611
612 /* For IEEE80211_RADIOTAP_FLAGS */
613 #define IEEE80211_RADIOTAP_F_CFP 0x01 /* sent/received
614 * during CFP
615 */
616 #define IEEE80211_RADIOTAP_F_SHORTPRE 0x02 /* sent/received
617 * with short
618 * preamble
619 */
620 #define IEEE80211_RADIOTAP_F_WEP 0x04 /* sent/received
621 * with WEP encryption
622 */
623 #define IEEE80211_RADIOTAP_F_FRAG 0x08 /* sent/received
624 * with fragmentation
625 */
626 #define IEEE80211_RADIOTAP_F_FCS 0x10 /* frame includes FCS */
627 #define IEEE80211_RADIOTAP_F_DATAPAD 0x20 /* frame has padding between
628 * 802.11 header and payload
629 * (to 32-bit boundary)
630 */
631 #define IEEE80211_RADIOTAP_F_BADFCS 0x40 /* does not pass FCS check */
632
633 /* For IEEE80211_RADIOTAP_RX_FLAGS */
634 #define IEEE80211_RADIOTAP_F_RX_BADFCS 0x0001 /* frame failed crc check */
635 #define IEEE80211_RADIOTAP_F_RX_PLCP_CRC 0x0002 /* frame failed PLCP CRC check */
636
637 /* For IEEE80211_RADIOTAP_MCS known */
638 #define IEEE80211_RADIOTAP_MCS_BANDWIDTH_KNOWN 0x01
639 #define IEEE80211_RADIOTAP_MCS_MCS_INDEX_KNOWN 0x02 /* MCS index field */
640 #define IEEE80211_RADIOTAP_MCS_GUARD_INTERVAL_KNOWN 0x04
641 #define IEEE80211_RADIOTAP_MCS_HT_FORMAT_KNOWN 0x08
642 #define IEEE80211_RADIOTAP_MCS_FEC_TYPE_KNOWN 0x10
643 #define IEEE80211_RADIOTAP_MCS_STBC_KNOWN 0x20
644
645 /* For IEEE80211_RADIOTAP_MCS flags */
646 #define IEEE80211_RADIOTAP_MCS_BANDWIDTH_MASK 0x03
647 #define IEEE80211_RADIOTAP_MCS_BANDWIDTH_20 0
648 #define IEEE80211_RADIOTAP_MCS_BANDWIDTH_40 1
649 #define IEEE80211_RADIOTAP_MCS_BANDWIDTH_20L 2
650 #define IEEE80211_RADIOTAP_MCS_BANDWIDTH_20U 3
651 #define IEEE80211_RADIOTAP_MCS_SHORT_GI 0x04 /* short guard interval */
652 #define IEEE80211_RADIOTAP_MCS_HT_GREENFIELD 0x08
653 #define IEEE80211_RADIOTAP_MCS_FEC_LDPC 0x10
654 #define IEEE80211_RADIOTAP_MCS_STBC_MASK 0x60
655 #define IEEE80211_RADIOTAP_MCS_STBC_1 1
656 #define IEEE80211_RADIOTAP_MCS_STBC_2 2
657 #define IEEE80211_RADIOTAP_MCS_STBC_3 3
658 #define IEEE80211_RADIOTAP_MCS_STBC_SHIFT 5
659
660 static const char tstr[] = "[|802.11]";
661
662 /* Radiotap state */
663 /* This is used to save state when parsing/processing parameters */
664 struct radiotap_state
665 {
666 u_int32_t present;
667
668 u_int8_t rate;
669 };
670
671 #define PRINT_SSID(p) \
672 if (p.ssid_present) { \
673 printf(" ("); \
674 fn_print(p.ssid.ssid, NULL); \
675 printf(")"); \
676 }
677
678 #define PRINT_RATE(_sep, _r, _suf) \
679 printf("%s%2.1f%s", _sep, (.5 * ((_r) & 0x7f)), _suf)
680 #define PRINT_RATES(p) \
681 if (p.rates_present) { \
682 int z; \
683 const char *sep = " ["; \
684 for (z = 0; z < p.rates.length ; z++) { \
685 PRINT_RATE(sep, p.rates.rate[z], \
686 (p.rates.rate[z] & 0x80 ? "*" : "")); \
687 sep = " "; \
688 } \
689 if (p.rates.length != 0) \
690 printf(" Mbit]"); \
691 }
692
693 #define PRINT_DS_CHANNEL(p) \
694 if (p.ds_present) \
695 printf(" CH: %u", p.ds.channel); \
696 printf("%s", \
697 CAPABILITY_PRIVACY(p.capability_info) ? ", PRIVACY" : "" );
698
699 #define MAX_MCS_INDEX 76
700
701 /*
702 * Indices are:
703 *
704 * the MCS index (0-76);
705 *
706 * 0 for 20 MHz, 1 for 40 MHz;
707 *
708 * 0 for a long guard interval, 1 for a short guard interval.
709 */
710 static const float ieee80211_float_htrates[MAX_MCS_INDEX+1][2][2] = {
711 /* MCS 0 */
712 { /* 20 Mhz */ { 6.5, /* SGI */ 7.2, },
713 /* 40 Mhz */ { 13.5, /* SGI */ 15.0, },
714 },
715
716 /* MCS 1 */
717 { /* 20 Mhz */ { 13.0, /* SGI */ 14.4, },
718 /* 40 Mhz */ { 27.0, /* SGI */ 30.0, },
719 },
720
721 /* MCS 2 */
722 { /* 20 Mhz */ { 19.5, /* SGI */ 21.7, },
723 /* 40 Mhz */ { 40.5, /* SGI */ 45.0, },
724 },
725
726 /* MCS 3 */
727 { /* 20 Mhz */ { 26.0, /* SGI */ 28.9, },
728 /* 40 Mhz */ { 54.0, /* SGI */ 60.0, },
729 },
730
731 /* MCS 4 */
732 { /* 20 Mhz */ { 39.0, /* SGI */ 43.3, },
733 /* 40 Mhz */ { 81.0, /* SGI */ 90.0, },
734 },
735
736 /* MCS 5 */
737 { /* 20 Mhz */ { 52.0, /* SGI */ 57.8, },
738 /* 40 Mhz */ { 108.0, /* SGI */ 120.0, },
739 },
740
741 /* MCS 6 */
742 { /* 20 Mhz */ { 58.5, /* SGI */ 65.0, },
743 /* 40 Mhz */ { 121.5, /* SGI */ 135.0, },
744 },
745
746 /* MCS 7 */
747 { /* 20 Mhz */ { 65.0, /* SGI */ 72.2, },
748 /* 40 Mhz */ { 135.0, /* SGI */ 150.0, },
749 },
750
751 /* MCS 8 */
752 { /* 20 Mhz */ { 13.0, /* SGI */ 14.4, },
753 /* 40 Mhz */ { 27.0, /* SGI */ 30.0, },
754 },
755
756 /* MCS 9 */
757 { /* 20 Mhz */ { 26.0, /* SGI */ 28.9, },
758 /* 40 Mhz */ { 54.0, /* SGI */ 60.0, },
759 },
760
761 /* MCS 10 */
762 { /* 20 Mhz */ { 39.0, /* SGI */ 43.3, },
763 /* 40 Mhz */ { 81.0, /* SGI */ 90.0, },
764 },
765
766 /* MCS 11 */
767 { /* 20 Mhz */ { 52.0, /* SGI */ 57.8, },
768 /* 40 Mhz */ { 108.0, /* SGI */ 120.0, },
769 },
770
771 /* MCS 12 */
772 { /* 20 Mhz */ { 78.0, /* SGI */ 86.7, },
773 /* 40 Mhz */ { 162.0, /* SGI */ 180.0, },
774 },
775
776 /* MCS 13 */
777 { /* 20 Mhz */ { 104.0, /* SGI */ 115.6, },
778 /* 40 Mhz */ { 216.0, /* SGI */ 240.0, },
779 },
780
781 /* MCS 14 */
782 { /* 20 Mhz */ { 117.0, /* SGI */ 130.0, },
783 /* 40 Mhz */ { 243.0, /* SGI */ 270.0, },
784 },
785
786 /* MCS 15 */
787 { /* 20 Mhz */ { 130.0, /* SGI */ 144.4, },
788 /* 40 Mhz */ { 270.0, /* SGI */ 300.0, },
789 },
790
791 /* MCS 16 */
792 { /* 20 Mhz */ { 19.5, /* SGI */ 21.7, },
793 /* 40 Mhz */ { 40.5, /* SGI */ 45.0, },
794 },
795
796 /* MCS 17 */
797 { /* 20 Mhz */ { 39.0, /* SGI */ 43.3, },
798 /* 40 Mhz */ { 81.0, /* SGI */ 90.0, },
799 },
800
801 /* MCS 18 */
802 { /* 20 Mhz */ { 58.5, /* SGI */ 65.0, },
803 /* 40 Mhz */ { 121.5, /* SGI */ 135.0, },
804 },
805
806 /* MCS 19 */
807 { /* 20 Mhz */ { 78.0, /* SGI */ 86.7, },
808 /* 40 Mhz */ { 162.0, /* SGI */ 180.0, },
809 },
810
811 /* MCS 20 */
812 { /* 20 Mhz */ { 117.0, /* SGI */ 130.0, },
813 /* 40 Mhz */ { 243.0, /* SGI */ 270.0, },
814 },
815
816 /* MCS 21 */
817 { /* 20 Mhz */ { 156.0, /* SGI */ 173.3, },
818 /* 40 Mhz */ { 324.0, /* SGI */ 360.0, },
819 },
820
821 /* MCS 22 */
822 { /* 20 Mhz */ { 175.5, /* SGI */ 195.0, },
823 /* 40 Mhz */ { 364.5, /* SGI */ 405.0, },
824 },
825
826 /* MCS 23 */
827 { /* 20 Mhz */ { 195.0, /* SGI */ 216.7, },
828 /* 40 Mhz */ { 405.0, /* SGI */ 450.0, },
829 },
830
831 /* MCS 24 */
832 { /* 20 Mhz */ { 26.0, /* SGI */ 28.9, },
833 /* 40 Mhz */ { 54.0, /* SGI */ 60.0, },
834 },
835
836 /* MCS 25 */
837 { /* 20 Mhz */ { 52.0, /* SGI */ 57.8, },
838 /* 40 Mhz */ { 108.0, /* SGI */ 120.0, },
839 },
840
841 /* MCS 26 */
842 { /* 20 Mhz */ { 78.0, /* SGI */ 86.7, },
843 /* 40 Mhz */ { 162.0, /* SGI */ 180.0, },
844 },
845
846 /* MCS 27 */
847 { /* 20 Mhz */ { 104.0, /* SGI */ 115.6, },
848 /* 40 Mhz */ { 216.0, /* SGI */ 240.0, },
849 },
850
851 /* MCS 28 */
852 { /* 20 Mhz */ { 156.0, /* SGI */ 173.3, },
853 /* 40 Mhz */ { 324.0, /* SGI */ 360.0, },
854 },
855
856 /* MCS 29 */
857 { /* 20 Mhz */ { 208.0, /* SGI */ 231.1, },
858 /* 40 Mhz */ { 432.0, /* SGI */ 480.0, },
859 },
860
861 /* MCS 30 */
862 { /* 20 Mhz */ { 234.0, /* SGI */ 260.0, },
863 /* 40 Mhz */ { 486.0, /* SGI */ 540.0, },
864 },
865
866 /* MCS 31 */
867 { /* 20 Mhz */ { 260.0, /* SGI */ 288.9, },
868 /* 40 Mhz */ { 540.0, /* SGI */ 600.0, },
869 },
870
871 /* MCS 32 */
872 { /* 20 Mhz */ { 0.0, /* SGI */ 0.0, }, /* not valid */
873 /* 40 Mhz */ { 6.0, /* SGI */ 6.7, },
874 },
875
876 /* MCS 33 */
877 { /* 20 Mhz */ { 39.0, /* SGI */ 43.3, },
878 /* 40 Mhz */ { 81.0, /* SGI */ 90.0, },
879 },
880
881 /* MCS 34 */
882 { /* 20 Mhz */ { 52.0, /* SGI */ 57.8, },
883 /* 40 Mhz */ { 108.0, /* SGI */ 120.0, },
884 },
885
886 /* MCS 35 */
887 { /* 20 Mhz */ { 65.0, /* SGI */ 72.2, },
888 /* 40 Mhz */ { 135.0, /* SGI */ 150.0, },
889 },
890
891 /* MCS 36 */
892 { /* 20 Mhz */ { 58.5, /* SGI */ 65.0, },
893 /* 40 Mhz */ { 121.5, /* SGI */ 135.0, },
894 },
895
896 /* MCS 37 */
897 { /* 20 Mhz */ { 78.0, /* SGI */ 86.7, },
898 /* 40 Mhz */ { 162.0, /* SGI */ 180.0, },
899 },
900
901 /* MCS 38 */
902 { /* 20 Mhz */ { 97.5, /* SGI */ 108.3, },
903 /* 40 Mhz */ { 202.5, /* SGI */ 225.0, },
904 },
905
906 /* MCS 39 */
907 { /* 20 Mhz */ { 52.0, /* SGI */ 57.8, },
908 /* 40 Mhz */ { 108.0, /* SGI */ 120.0, },
909 },
910
911 /* MCS 40 */
912 { /* 20 Mhz */ { 65.0, /* SGI */ 72.2, },
913 /* 40 Mhz */ { 135.0, /* SGI */ 150.0, },
914 },
915
916 /* MCS 41 */
917 { /* 20 Mhz */ { 65.0, /* SGI */ 72.2, },
918 /* 40 Mhz */ { 135.0, /* SGI */ 150.0, },
919 },
920
921 /* MCS 42 */
922 { /* 20 Mhz */ { 78.0, /* SGI */ 86.7, },
923 /* 40 Mhz */ { 162.0, /* SGI */ 180.0, },
924 },
925
926 /* MCS 43 */
927 { /* 20 Mhz */ { 91.0, /* SGI */ 101.1, },
928 /* 40 Mhz */ { 189.0, /* SGI */ 210.0, },
929 },
930
931 /* MCS 44 */
932 { /* 20 Mhz */ { 91.0, /* SGI */ 101.1, },
933 /* 40 Mhz */ { 189.0, /* SGI */ 210.0, },
934 },
935
936 /* MCS 45 */
937 { /* 20 Mhz */ { 104.0, /* SGI */ 115.6, },
938 /* 40 Mhz */ { 216.0, /* SGI */ 240.0, },
939 },
940
941 /* MCS 46 */
942 { /* 20 Mhz */ { 78.0, /* SGI */ 86.7, },
943 /* 40 Mhz */ { 162.0, /* SGI */ 180.0, },
944 },
945
946 /* MCS 47 */
947 { /* 20 Mhz */ { 97.5, /* SGI */ 108.3, },
948 /* 40 Mhz */ { 202.5, /* SGI */ 225.0, },
949 },
950
951 /* MCS 48 */
952 { /* 20 Mhz */ { 97.5, /* SGI */ 108.3, },
953 /* 40 Mhz */ { 202.5, /* SGI */ 225.0, },
954 },
955
956 /* MCS 49 */
957 { /* 20 Mhz */ { 117.0, /* SGI */ 130.0, },
958 /* 40 Mhz */ { 243.0, /* SGI */ 270.0, },
959 },
960
961 /* MCS 50 */
962 { /* 20 Mhz */ { 136.5, /* SGI */ 151.7, },
963 /* 40 Mhz */ { 283.5, /* SGI */ 315.0, },
964 },
965
966 /* MCS 51 */
967 { /* 20 Mhz */ { 136.5, /* SGI */ 151.7, },
968 /* 40 Mhz */ { 283.5, /* SGI */ 315.0, },
969 },
970
971 /* MCS 52 */
972 { /* 20 Mhz */ { 156.0, /* SGI */ 173.3, },
973 /* 40 Mhz */ { 324.0, /* SGI */ 360.0, },
974 },
975
976 /* MCS 53 */
977 { /* 20 Mhz */ { 65.0, /* SGI */ 72.2, },
978 /* 40 Mhz */ { 135.0, /* SGI */ 150.0, },
979 },
980
981 /* MCS 54 */
982 { /* 20 Mhz */ { 78.0, /* SGI */ 86.7, },
983 /* 40 Mhz */ { 162.0, /* SGI */ 180.0, },
984 },
985
986 /* MCS 55 */
987 { /* 20 Mhz */ { 91.0, /* SGI */ 101.1, },
988 /* 40 Mhz */ { 189.0, /* SGI */ 210.0, },
989 },
990
991 /* MCS 56 */
992 { /* 20 Mhz */ { 78.0, /* SGI */ 86.7, },
993 /* 40 Mhz */ { 162.0, /* SGI */ 180.0, },
994 },
995
996 /* MCS 57 */
997 { /* 20 Mhz */ { 91.0, /* SGI */ 101.1, },
998 /* 40 Mhz */ { 189.0, /* SGI */ 210.0, },
999 },
1000
1001 /* MCS 58 */
1002 { /* 20 Mhz */ { 104.0, /* SGI */ 115.6, },
1003 /* 40 Mhz */ { 216.0, /* SGI */ 240.0, },
1004 },
1005
1006 /* MCS 59 */
1007 { /* 20 Mhz */ { 117.0, /* SGI */ 130.0, },
1008 /* 40 Mhz */ { 243.0, /* SGI */ 270.0, },
1009 },
1010
1011 /* MCS 60 */
1012 { /* 20 Mhz */ { 104.0, /* SGI */ 115.6, },
1013 /* 40 Mhz */ { 216.0, /* SGI */ 240.0, },
1014 },
1015
1016 /* MCS 61 */
1017 { /* 20 Mhz */ { 117.0, /* SGI */ 130.0, },
1018 /* 40 Mhz */ { 243.0, /* SGI */ 270.0, },
1019 },
1020
1021 /* MCS 62 */
1022 { /* 20 Mhz */ { 130.0, /* SGI */ 144.4, },
1023 /* 40 Mhz */ { 270.0, /* SGI */ 300.0, },
1024 },
1025
1026 /* MCS 63 */
1027 { /* 20 Mhz */ { 130.0, /* SGI */ 144.4, },
1028 /* 40 Mhz */ { 270.0, /* SGI */ 300.0, },
1029 },
1030
1031 /* MCS 64 */
1032 { /* 20 Mhz */ { 143.0, /* SGI */ 158.9, },
1033 /* 40 Mhz */ { 297.0, /* SGI */ 330.0, },
1034 },
1035
1036 /* MCS 65 */
1037 { /* 20 Mhz */ { 97.5, /* SGI */ 108.3, },
1038 /* 40 Mhz */ { 202.5, /* SGI */ 225.0, },
1039 },
1040
1041 /* MCS 66 */
1042 { /* 20 Mhz */ { 117.0, /* SGI */ 130.0, },
1043 /* 40 Mhz */ { 243.0, /* SGI */ 270.0, },
1044 },
1045
1046 /* MCS 67 */
1047 { /* 20 Mhz */ { 136.5, /* SGI */ 151.7, },
1048 /* 40 Mhz */ { 283.5, /* SGI */ 315.0, },
1049 },
1050
1051 /* MCS 68 */
1052 { /* 20 Mhz */ { 117.0, /* SGI */ 130.0, },
1053 /* 40 Mhz */ { 243.0, /* SGI */ 270.0, },
1054 },
1055
1056 /* MCS 69 */
1057 { /* 20 Mhz */ { 136.5, /* SGI */ 151.7, },
1058 /* 40 Mhz */ { 283.5, /* SGI */ 315.0, },
1059 },
1060
1061 /* MCS 70 */
1062 { /* 20 Mhz */ { 156.0, /* SGI */ 173.3, },
1063 /* 40 Mhz */ { 324.0, /* SGI */ 360.0, },
1064 },
1065
1066 /* MCS 71 */
1067 { /* 20 Mhz */ { 175.5, /* SGI */ 195.0, },
1068 /* 40 Mhz */ { 364.5, /* SGI */ 405.0, },
1069 },
1070
1071 /* MCS 72 */
1072 { /* 20 Mhz */ { 156.0, /* SGI */ 173.3, },
1073 /* 40 Mhz */ { 324.0, /* SGI */ 360.0, },
1074 },
1075
1076 /* MCS 73 */
1077 { /* 20 Mhz */ { 175.5, /* SGI */ 195.0, },
1078 /* 40 Mhz */ { 364.5, /* SGI */ 405.0, },
1079 },
1080
1081 /* MCS 74 */
1082 { /* 20 Mhz */ { 195.0, /* SGI */ 216.7, },
1083 /* 40 Mhz */ { 405.0, /* SGI */ 450.0, },
1084 },
1085
1086 /* MCS 75 */
1087 { /* 20 Mhz */ { 195.0, /* SGI */ 216.7, },
1088 /* 40 Mhz */ { 405.0, /* SGI */ 450.0, },
1089 },
1090
1091 /* MCS 76 */
1092 { /* 20 Mhz */ { 214.5, /* SGI */ 238.3, },
1093 /* 40 Mhz */ { 445.5, /* SGI */ 495.0, },
1094 },
1095 };
1096
1097 static const char *auth_alg_text[]={"Open System","Shared Key","EAP"};
1098 #define NUM_AUTH_ALGS (sizeof auth_alg_text / sizeof auth_alg_text[0])
1099
1100 static const char *status_text[] = {
1101 "Successful", /* 0 */
1102 "Unspecified failure", /* 1 */
1103 "Reserved", /* 2 */
1104 "Reserved", /* 3 */
1105 "Reserved", /* 4 */
1106 "Reserved", /* 5 */
1107 "Reserved", /* 6 */
1108 "Reserved", /* 7 */
1109 "Reserved", /* 8 */
1110 "Reserved", /* 9 */
1111 "Cannot Support all requested capabilities in the Capability "
1112 "Information field", /* 10 */
1113 "Reassociation denied due to inability to confirm that association "
1114 "exists", /* 11 */
1115 "Association denied due to reason outside the scope of the "
1116 "standard", /* 12 */
1117 "Responding station does not support the specified authentication "
1118 "algorithm ", /* 13 */
1119 "Received an Authentication frame with authentication transaction "
1120 "sequence number out of expected sequence", /* 14 */
1121 "Authentication rejected because of challenge failure", /* 15 */
1122 "Authentication rejected due to timeout waiting for next frame in "
1123 "sequence", /* 16 */
1124 "Association denied because AP is unable to handle additional"
1125 "associated stations", /* 17 */
1126 "Association denied due to requesting station not supporting all of "
1127 "the data rates in BSSBasicRateSet parameter", /* 18 */
1128 "Association denied due to requesting station not supporting "
1129 "short preamble operation", /* 19 */
1130 "Association denied due to requesting station not supporting "
1131 "PBCC encoding", /* 20 */
1132 "Association denied due to requesting station not supporting "
1133 "channel agility", /* 21 */
1134 "Association request rejected because Spectrum Management "
1135 "capability is required", /* 22 */
1136 "Association request rejected because the information in the "
1137 "Power Capability element is unacceptable", /* 23 */
1138 "Association request rejected because the information in the "
1139 "Supported Channels element is unacceptable", /* 24 */
1140 "Association denied due to requesting station not supporting "
1141 "short slot operation", /* 25 */
1142 "Association denied due to requesting station not supporting "
1143 "DSSS-OFDM operation", /* 26 */
1144 "Association denied because the requested STA does not support HT "
1145 "features", /* 27 */
1146 "Reserved", /* 28 */
1147 "Association denied because the requested STA does not support "
1148 "the PCO transition time required by the AP", /* 29 */
1149 "Reserved", /* 30 */
1150 "Reserved", /* 31 */
1151 "Unspecified, QoS-related failure", /* 32 */
1152 "Association denied due to QAP having insufficient bandwidth "
1153 "to handle another QSTA", /* 33 */
1154 "Association denied due to excessive frame loss rates and/or "
1155 "poor conditions on current operating channel", /* 34 */
1156 "Association (with QBSS) denied due to requesting station not "
1157 "supporting the QoS facility", /* 35 */
1158 "Association denied due to requesting station not supporting "
1159 "Block Ack", /* 36 */
1160 "The request has been declined", /* 37 */
1161 "The request has not been successful as one or more parameters "
1162 "have invalid values", /* 38 */
1163 "The TS has not been created because the request cannot be honored. "
1164 "However, a suggested TSPEC is provided so that the initiating QSTA"
1165 "may attempt to set another TS with the suggested changes to the "
1166 "TSPEC", /* 39 */
1167 "Invalid Information Element", /* 40 */
1168 "Group Cipher is not valid", /* 41 */
1169 "Pairwise Cipher is not valid", /* 42 */
1170 "AKMP is not valid", /* 43 */
1171 "Unsupported RSN IE version", /* 44 */
1172 "Invalid RSN IE Capabilities", /* 45 */
1173 "Cipher suite is rejected per security policy", /* 46 */
1174 "The TS has not been created. However, the HC may be capable of "
1175 "creating a TS, in response to a request, after the time indicated "
1176 "in the TS Delay element", /* 47 */
1177 "Direct Link is not allowed in the BSS by policy", /* 48 */
1178 "Destination STA is not present within this QBSS.", /* 49 */
1179 "The Destination STA is not a QSTA.", /* 50 */
1180
1181 };
1182 #define NUM_STATUSES (sizeof status_text / sizeof status_text[0])
1183
1184 static const char *reason_text[] = {
1185 "Reserved", /* 0 */
1186 "Unspecified reason", /* 1 */
1187 "Previous authentication no longer valid", /* 2 */
1188 "Deauthenticated because sending station is leaving (or has left) "
1189 "IBSS or ESS", /* 3 */
1190 "Disassociated due to inactivity", /* 4 */
1191 "Disassociated because AP is unable to handle all currently "
1192 " associated stations", /* 5 */
1193 "Class 2 frame received from nonauthenticated station", /* 6 */
1194 "Class 3 frame received from nonassociated station", /* 7 */
1195 "Disassociated because sending station is leaving "
1196 "(or has left) BSS", /* 8 */
1197 "Station requesting (re)association is not authenticated with "
1198 "responding station", /* 9 */
1199 "Disassociated because the information in the Power Capability "
1200 "element is unacceptable", /* 10 */
1201 "Disassociated because the information in the SupportedChannels "
1202 "element is unacceptable", /* 11 */
1203 "Invalid Information Element", /* 12 */
1204 "Reserved", /* 13 */
1205 "Michael MIC failure", /* 14 */
1206 "4-Way Handshake timeout", /* 15 */
1207 "Group key update timeout", /* 16 */
1208 "Information element in 4-Way Handshake different from (Re)Association"
1209 "Request/Probe Response/Beacon", /* 17 */
1210 "Group Cipher is not valid", /* 18 */
1211 "AKMP is not valid", /* 20 */
1212 "Unsupported RSN IE version", /* 21 */
1213 "Invalid RSN IE Capabilities", /* 22 */
1214 "IEEE 802.1X Authentication failed", /* 23 */
1215 "Cipher suite is rejected per security policy", /* 24 */
1216 "Reserved", /* 25 */
1217 "Reserved", /* 26 */
1218 "Reserved", /* 27 */
1219 "Reserved", /* 28 */
1220 "Reserved", /* 29 */
1221 "Reserved", /* 30 */
1222 "TS deleted because QoS AP lacks sufficient bandwidth for this "
1223 "QoS STA due to a change in BSS service characteristics or "
1224 "operational mode (e.g. an HT BSS change from 40 MHz channel "
1225 "to 20 MHz channel)", /* 31 */
1226 "Disassociated for unspecified, QoS-related reason", /* 32 */
1227 "Disassociated because QoS AP lacks sufficient bandwidth for this "
1228 "QoS STA", /* 33 */
1229 "Disassociated because of excessive number of frames that need to be "
1230 "acknowledged, but are not acknowledged for AP transmissions "
1231 "and/or poor channel conditions", /* 34 */
1232 "Disassociated because STA is transmitting outside the limits "
1233 "of its TXOPs", /* 35 */
1234 "Requested from peer STA as the STA is leaving the BSS "
1235 "(or resetting)", /* 36 */
1236 "Requested from peer STA as it does not want to use the "
1237 "mechanism", /* 37 */
1238 "Requested from peer STA as the STA received frames using the "
1239 "mechanism for which a set up is required", /* 38 */
1240 "Requested from peer STA due to time out", /* 39 */
1241 "Reserved", /* 40 */
1242 "Reserved", /* 41 */
1243 "Reserved", /* 42 */
1244 "Reserved", /* 43 */
1245 "Reserved", /* 44 */
1246 "Peer STA does not support the requested cipher suite", /* 45 */
1247 "Association denied due to requesting STA not supporting HT "
1248 "features", /* 46 */
1249 };
1250 #define NUM_REASONS (sizeof reason_text / sizeof reason_text[0])
1251
1252 static int
1253 wep_print(const u_char *p)
1254 {
1255 u_int32_t iv;
1256
1257 if (!TTEST2(*p, IEEE802_11_IV_LEN + IEEE802_11_KID_LEN))
1258 return 0;
1259 iv = EXTRACT_LE_32BITS(p);
1260
1261 printf("Data IV:%3x Pad %x KeyID %x", IV_IV(iv), IV_PAD(iv),
1262 IV_KEYID(iv));
1263
1264 return 1;
1265 }
1266
1267 static int
1268 parse_elements(struct mgmt_body_t *pbody, const u_char *p, int offset,
1269 u_int length)
1270 {
1271 u_int elementlen;
1272 struct ssid_t ssid;
1273 struct challenge_t challenge;
1274 struct rates_t rates;
1275 struct ds_t ds;
1276 struct cf_t cf;
1277 struct tim_t tim;
1278
1279 /*
1280 * We haven't seen any elements yet.
1281 */
1282 pbody->challenge_present = 0;
1283 pbody->ssid_present = 0;
1284 pbody->rates_present = 0;
1285 pbody->ds_present = 0;
1286 pbody->cf_present = 0;
1287 pbody->tim_present = 0;
1288
1289 while (length != 0) {
1290 if (!TTEST2(*(p + offset), 1))
1291 return 0;
1292 if (length < 1)
1293 return 0;
1294 switch (*(p + offset)) {
1295 case E_SSID:
1296 if (!TTEST2(*(p + offset), 2))
1297 return 0;
1298 if (length < 2)
1299 return 0;
1300 memcpy(&ssid, p + offset, 2);
1301 offset += 2;
1302 length -= 2;
1303 if (ssid.length != 0) {
1304 if (ssid.length > sizeof(ssid.ssid) - 1)
1305 return 0;
1306 if (!TTEST2(*(p + offset), ssid.length))
1307 return 0;
1308 if (length < ssid.length)
1309 return 0;
1310 memcpy(&ssid.ssid, p + offset, ssid.length);
1311 offset += ssid.length;
1312 length -= ssid.length;
1313 }
1314 ssid.ssid[ssid.length] = '\0';
1315 /*
1316 * Present and not truncated.
1317 *
1318 * If we haven't already seen an SSID IE,
1319 * copy this one, otherwise ignore this one,
1320 * so we later report the first one we saw.
1321 */
1322 if (!pbody->ssid_present) {
1323 pbody->ssid = ssid;
1324 pbody->ssid_present = 1;
1325 }
1326 break;
1327 case E_CHALLENGE:
1328 if (!TTEST2(*(p + offset), 2))
1329 return 0;
1330 if (length < 2)
1331 return 0;
1332 memcpy(&challenge, p + offset, 2);
1333 offset += 2;
1334 length -= 2;
1335 if (challenge.length != 0) {
1336 if (challenge.length >
1337 sizeof(challenge.text) - 1)
1338 return 0;
1339 if (!TTEST2(*(p + offset), challenge.length))
1340 return 0;
1341 if (length < challenge.length)
1342 return 0;
1343 memcpy(&challenge.text, p + offset,
1344 challenge.length);
1345 offset += challenge.length;
1346 length -= challenge.length;
1347 }
1348 challenge.text[challenge.length] = '\0';
1349 /*
1350 * Present and not truncated.
1351 *
1352 * If we haven't already seen a challenge IE,
1353 * copy this one, otherwise ignore this one,
1354 * so we later report the first one we saw.
1355 */
1356 if (!pbody->challenge_present) {
1357 pbody->challenge = challenge;
1358 pbody->challenge_present = 1;
1359 }
1360 break;
1361 case E_RATES:
1362 if (!TTEST2(*(p + offset), 2))
1363 return 0;
1364 if (length < 2)
1365 return 0;
1366 memcpy(&rates, p + offset, 2);
1367 offset += 2;
1368 length -= 2;
1369 if (rates.length != 0) {
1370 if (rates.length > sizeof rates.rate)
1371 return 0;
1372 if (!TTEST2(*(p + offset), rates.length))
1373 return 0;
1374 if (length < rates.length)
1375 return 0;
1376 memcpy(&rates.rate, p + offset, rates.length);
1377 offset += rates.length;
1378 length -= rates.length;
1379 }
1380 /*
1381 * Present and not truncated.
1382 *
1383 * If we haven't already seen a rates IE,
1384 * copy this one if it's not zero-length,
1385 * otherwise ignore this one, so we later
1386 * report the first one we saw.
1387 *
1388 * We ignore zero-length rates IEs as some
1389 * devices seem to put a zero-length rates
1390 * IE, followed by an SSID IE, followed by
1391 * a non-zero-length rates IE into frames,
1392 * even though IEEE Std 802.11-2007 doesn't
1393 * seem to indicate that a zero-length rates
1394 * IE is valid.
1395 */
1396 if (!pbody->rates_present && rates.length != 0) {
1397 pbody->rates = rates;
1398 pbody->rates_present = 1;
1399 }
1400 break;
1401 case E_DS:
1402 if (!TTEST2(*(p + offset), 3))
1403 return 0;
1404 if (length < 3)
1405 return 0;
1406 memcpy(&ds, p + offset, 3);
1407 offset += 3;
1408 length -= 3;
1409 /*
1410 * Present and not truncated.
1411 *
1412 * If we haven't already seen a DS IE,
1413 * copy this one, otherwise ignore this one,
1414 * so we later report the first one we saw.
1415 */
1416 if (!pbody->ds_present) {
1417 pbody->ds = ds;
1418 pbody->ds_present = 1;
1419 }
1420 break;
1421 case E_CF:
1422 if (!TTEST2(*(p + offset), 8))
1423 return 0;
1424 if (length < 8)
1425 return 0;
1426 memcpy(&cf, p + offset, 8);
1427 offset += 8;
1428 length -= 8;
1429 /*
1430 * Present and not truncated.
1431 *
1432 * If we haven't already seen a CF IE,
1433 * copy this one, otherwise ignore this one,
1434 * so we later report the first one we saw.
1435 */
1436 if (!pbody->cf_present) {
1437 pbody->cf = cf;
1438 pbody->cf_present = 1;
1439 }
1440 break;
1441 case E_TIM:
1442 if (!TTEST2(*(p + offset), 2))
1443 return 0;
1444 if (length < 2)
1445 return 0;
1446 memcpy(&tim, p + offset, 2);
1447 offset += 2;
1448 length -= 2;
1449 if (!TTEST2(*(p + offset), 3))
1450 return 0;
1451 if (length < 3)
1452 return 0;
1453 memcpy(&tim.count, p + offset, 3);
1454 offset += 3;
1455 length -= 3;
1456
1457 if (tim.length <= 3)
1458 break;
1459 if (tim.length - 3 > (int)sizeof tim.bitmap)
1460 return 0;
1461 if (!TTEST2(*(p + offset), tim.length - 3))
1462 return 0;
1463 if (length < (u_int)(tim.length - 3))
1464 return 0;
1465 memcpy(tim.bitmap, p + (tim.length - 3),
1466 (tim.length - 3));
1467 offset += tim.length - 3;
1468 length -= tim.length - 3;
1469 /*
1470 * Present and not truncated.
1471 *
1472 * If we haven't already seen a TIM IE,
1473 * copy this one, otherwise ignore this one,
1474 * so we later report the first one we saw.
1475 */
1476 if (!pbody->tim_present) {
1477 pbody->tim = tim;
1478 pbody->tim_present = 1;
1479 }
1480 break;
1481 default:
1482 #if 0
1483 printf("(1) unhandled element_id (%d) ",
1484 *(p + offset));
1485 #endif
1486 if (!TTEST2(*(p + offset), 2))
1487 return 0;
1488 if (length < 2)
1489 return 0;
1490 elementlen = *(p + offset + 1);
1491 if (!TTEST2(*(p + offset + 2), elementlen))
1492 return 0;
1493 if (length < elementlen + 2)
1494 return 0;
1495 offset += elementlen + 2;
1496 length -= elementlen + 2;
1497 break;
1498 }
1499 }
1500
1501 /* No problems found. */
1502 return 1;
1503 }
1504
1505 /*********************************************************************************
1506 * Print Handle functions for the management frame types
1507 *********************************************************************************/
1508
1509 static int
1510 handle_beacon(const u_char *p, u_int length)
1511 {
1512 struct mgmt_body_t pbody;
1513 int offset = 0;
1514 int ret;
1515
1516 memset(&pbody, 0, sizeof(pbody));
1517
1518 if (!TTEST2(*p, IEEE802_11_TSTAMP_LEN + IEEE802_11_BCNINT_LEN +
1519 IEEE802_11_CAPINFO_LEN))
1520 return 0;
1521 if (length < IEEE802_11_TSTAMP_LEN + IEEE802_11_BCNINT_LEN +
1522 IEEE802_11_CAPINFO_LEN)
1523 return 0;
1524 memcpy(&pbody.timestamp, p, IEEE802_11_TSTAMP_LEN);
1525 offset += IEEE802_11_TSTAMP_LEN;
1526 length -= IEEE802_11_TSTAMP_LEN;
1527 pbody.beacon_interval = EXTRACT_LE_16BITS(p+offset);
1528 offset += IEEE802_11_BCNINT_LEN;
1529 length -= IEEE802_11_BCNINT_LEN;
1530 pbody.capability_info = EXTRACT_LE_16BITS(p+offset);
1531 offset += IEEE802_11_CAPINFO_LEN;
1532 length -= IEEE802_11_CAPINFO_LEN;
1533
1534 ret = parse_elements(&pbody, p, offset, length);
1535
1536 PRINT_SSID(pbody);
1537 PRINT_RATES(pbody);
1538 printf(" %s",
1539 CAPABILITY_ESS(pbody.capability_info) ? "ESS" : "IBSS");
1540 PRINT_DS_CHANNEL(pbody);
1541
1542 return ret;
1543 }
1544
1545 static int
1546 handle_assoc_request(const u_char *p, u_int length)
1547 {
1548 struct mgmt_body_t pbody;
1549 int offset = 0;
1550 int ret;
1551
1552 memset(&pbody, 0, sizeof(pbody));
1553
1554 if (!TTEST2(*p, IEEE802_11_CAPINFO_LEN + IEEE802_11_LISTENINT_LEN))
1555 return 0;
1556 if (length < IEEE802_11_CAPINFO_LEN + IEEE802_11_LISTENINT_LEN)
1557 return 0;
1558 pbody.capability_info = EXTRACT_LE_16BITS(p);
1559 offset += IEEE802_11_CAPINFO_LEN;
1560 length -= IEEE802_11_CAPINFO_LEN;
1561 pbody.listen_interval = EXTRACT_LE_16BITS(p+offset);
1562 offset += IEEE802_11_LISTENINT_LEN;
1563 length -= IEEE802_11_LISTENINT_LEN;
1564
1565 ret = parse_elements(&pbody, p, offset, length);
1566
1567 PRINT_SSID(pbody);
1568 PRINT_RATES(pbody);
1569 return ret;
1570 }
1571
1572 static int
1573 handle_assoc_response(const u_char *p, u_int length)
1574 {
1575 struct mgmt_body_t pbody;
1576 int offset = 0;
1577 int ret;
1578
1579 memset(&pbody, 0, sizeof(pbody));
1580
1581 if (!TTEST2(*p, IEEE802_11_CAPINFO_LEN + IEEE802_11_STATUS_LEN +
1582 IEEE802_11_AID_LEN))
1583 return 0;
1584 if (length < IEEE802_11_CAPINFO_LEN + IEEE802_11_STATUS_LEN +
1585 IEEE802_11_AID_LEN)
1586 return 0;
1587 pbody.capability_info = EXTRACT_LE_16BITS(p);
1588 offset += IEEE802_11_CAPINFO_LEN;
1589 length -= IEEE802_11_CAPINFO_LEN;
1590 pbody.status_code = EXTRACT_LE_16BITS(p+offset);
1591 offset += IEEE802_11_STATUS_LEN;
1592 length -= IEEE802_11_STATUS_LEN;
1593 pbody.aid = EXTRACT_LE_16BITS(p+offset);
1594 offset += IEEE802_11_AID_LEN;
1595 length -= IEEE802_11_AID_LEN;
1596
1597 ret = parse_elements(&pbody, p, offset, length);
1598
1599 printf(" AID(%x) :%s: %s", ((u_int16_t)(pbody.aid << 2 )) >> 2 ,
1600 CAPABILITY_PRIVACY(pbody.capability_info) ? " PRIVACY " : "",
1601 (pbody.status_code < NUM_STATUSES
1602 ? status_text[pbody.status_code]
1603 : "n/a"));
1604
1605 return ret;
1606 }
1607
1608 static int
1609 handle_reassoc_request(const u_char *p, u_int length)
1610 {
1611 struct mgmt_body_t pbody;
1612 int offset = 0;
1613 int ret;
1614
1615 memset(&pbody, 0, sizeof(pbody));
1616
1617 if (!TTEST2(*p, IEEE802_11_CAPINFO_LEN + IEEE802_11_LISTENINT_LEN +
1618 IEEE802_11_AP_LEN))
1619 return 0;
1620 if (length < IEEE802_11_CAPINFO_LEN + IEEE802_11_LISTENINT_LEN +
1621 IEEE802_11_AP_LEN)
1622 return 0;
1623 pbody.capability_info = EXTRACT_LE_16BITS(p);
1624 offset += IEEE802_11_CAPINFO_LEN;
1625 length -= IEEE802_11_CAPINFO_LEN;
1626 pbody.listen_interval = EXTRACT_LE_16BITS(p+offset);
1627 offset += IEEE802_11_LISTENINT_LEN;
1628 length -= IEEE802_11_LISTENINT_LEN;
1629 memcpy(&pbody.ap, p+offset, IEEE802_11_AP_LEN);
1630 offset += IEEE802_11_AP_LEN;
1631 length -= IEEE802_11_AP_LEN;
1632
1633 ret = parse_elements(&pbody, p, offset, length);
1634
1635 PRINT_SSID(pbody);
1636 printf(" AP : %s", etheraddr_string( pbody.ap ));
1637
1638 return ret;
1639 }
1640
1641 static int
1642 handle_reassoc_response(const u_char *p, u_int length)
1643 {
1644 /* Same as a Association Reponse */
1645 return handle_assoc_response(p, length);
1646 }
1647
1648 static int
1649 handle_probe_request(const u_char *p, u_int length)
1650 {
1651 struct mgmt_body_t pbody;
1652 int offset = 0;
1653 int ret;
1654
1655 memset(&pbody, 0, sizeof(pbody));
1656
1657 ret = parse_elements(&pbody, p, offset, length);
1658
1659 PRINT_SSID(pbody);
1660 PRINT_RATES(pbody);
1661
1662 return ret;
1663 }
1664
1665 static int
1666 handle_probe_response(const u_char *p, u_int length)
1667 {
1668 struct mgmt_body_t pbody;
1669 int offset = 0;
1670 int ret;
1671
1672 memset(&pbody, 0, sizeof(pbody));
1673
1674 if (!TTEST2(*p, IEEE802_11_TSTAMP_LEN + IEEE802_11_BCNINT_LEN +
1675 IEEE802_11_CAPINFO_LEN))
1676 return 0;
1677 if (length < IEEE802_11_TSTAMP_LEN + IEEE802_11_BCNINT_LEN +
1678 IEEE802_11_CAPINFO_LEN)
1679 return 0;
1680 memcpy(&pbody.timestamp, p, IEEE802_11_TSTAMP_LEN);
1681 offset += IEEE802_11_TSTAMP_LEN;
1682 length -= IEEE802_11_TSTAMP_LEN;
1683 pbody.beacon_interval = EXTRACT_LE_16BITS(p+offset);
1684 offset += IEEE802_11_BCNINT_LEN;
1685 length -= IEEE802_11_BCNINT_LEN;
1686 pbody.capability_info = EXTRACT_LE_16BITS(p+offset);
1687 offset += IEEE802_11_CAPINFO_LEN;
1688 length -= IEEE802_11_CAPINFO_LEN;
1689
1690 ret = parse_elements(&pbody, p, offset, length);
1691
1692 PRINT_SSID(pbody);
1693 PRINT_RATES(pbody);
1694 PRINT_DS_CHANNEL(pbody);
1695
1696 return ret;
1697 }
1698
1699 static int
1700 handle_atim(void)
1701 {
1702 /* the frame body for ATIM is null. */
1703 return 1;
1704 }
1705
1706 static int
1707 handle_disassoc(const u_char *p, u_int length)
1708 {
1709 struct mgmt_body_t pbody;
1710
1711 memset(&pbody, 0, sizeof(pbody));
1712
1713 if (!TTEST2(*p, IEEE802_11_REASON_LEN))
1714 return 0;
1715 if (length < IEEE802_11_REASON_LEN)
1716 return 0;
1717 pbody.reason_code = EXTRACT_LE_16BITS(p);
1718
1719 printf(": %s",
1720 (pbody.reason_code < NUM_REASONS)
1721 ? reason_text[pbody.reason_code]
1722 : "Reserved" );
1723
1724 return 1;
1725 }
1726
1727 static int
1728 handle_auth(const u_char *p, u_int length)
1729 {
1730 struct mgmt_body_t pbody;
1731 int offset = 0;
1732 int ret;
1733
1734 memset(&pbody, 0, sizeof(pbody));
1735
1736 if (!TTEST2(*p, 6))
1737 return 0;
1738 if (length < 6)
1739 return 0;
1740 pbody.auth_alg = EXTRACT_LE_16BITS(p);
1741 offset += 2;
1742 length -= 2;
1743 pbody.auth_trans_seq_num = EXTRACT_LE_16BITS(p + offset);
1744 offset += 2;
1745 length -= 2;
1746 pbody.status_code = EXTRACT_LE_16BITS(p + offset);
1747 offset += 2;
1748 length -= 2;
1749
1750 ret = parse_elements(&pbody, p, offset, length);
1751
1752 if ((pbody.auth_alg == 1) &&
1753 ((pbody.auth_trans_seq_num == 2) ||
1754 (pbody.auth_trans_seq_num == 3))) {
1755 printf(" (%s)-%x [Challenge Text] %s",
1756 (pbody.auth_alg < NUM_AUTH_ALGS)
1757 ? auth_alg_text[pbody.auth_alg]
1758 : "Reserved",
1759 pbody.auth_trans_seq_num,
1760 ((pbody.auth_trans_seq_num % 2)
1761 ? ((pbody.status_code < NUM_STATUSES)
1762 ? status_text[pbody.status_code]
1763 : "n/a") : ""));
1764 return ret;
1765 }
1766 printf(" (%s)-%x: %s",
1767 (pbody.auth_alg < NUM_AUTH_ALGS)
1768 ? auth_alg_text[pbody.auth_alg]
1769 : "Reserved",
1770 pbody.auth_trans_seq_num,
1771 (pbody.auth_trans_seq_num % 2)
1772 ? ((pbody.status_code < NUM_STATUSES)
1773 ? status_text[pbody.status_code]
1774 : "n/a")
1775 : "");
1776
1777 return ret;
1778 }
1779
1780 static int
1781 handle_deauth(const struct mgmt_header_t *pmh, const u_char *p, u_int length)
1782 {
1783 struct mgmt_body_t pbody;
1784 const char *reason = NULL;
1785
1786 memset(&pbody, 0, sizeof(pbody));
1787
1788 if (!TTEST2(*p, IEEE802_11_REASON_LEN))
1789 return 0;
1790 if (length < IEEE802_11_REASON_LEN)
1791 return 0;
1792 pbody.reason_code = EXTRACT_LE_16BITS(p);
1793
1794 reason = (pbody.reason_code < NUM_REASONS)
1795 ? reason_text[pbody.reason_code]
1796 : "Reserved";
1797
1798 if (eflag) {
1799 printf(": %s", reason);
1800 } else {
1801 printf(" (%s): %s", etheraddr_string(pmh->sa), reason);
1802 }
1803 return 1;
1804 }
1805
1806 #define PRINT_HT_ACTION(v) (\
1807 (v) == 0 ? printf("TxChWidth") : \
1808 (v) == 1 ? printf("MIMOPwrSave") : \
1809 printf("Act#%d", (v)) \
1810 )
1811 #define PRINT_BA_ACTION(v) (\
1812 (v) == 0 ? printf("ADDBA Request") : \
1813 (v) == 1 ? printf("ADDBA Response") : \
1814 (v) == 2 ? printf("DELBA") : \
1815 printf("Act#%d", (v)) \
1816 )
1817 #define PRINT_MESHLINK_ACTION(v) (\
1818 (v) == 0 ? printf("Request") : \
1819 (v) == 1 ? printf("Report") : \
1820 printf("Act#%d", (v)) \
1821 )
1822 #define PRINT_MESHPEERING_ACTION(v) (\
1823 (v) == 0 ? printf("Open") : \
1824 (v) == 1 ? printf("Confirm") : \
1825 (v) == 2 ? printf("Close") : \
1826 printf("Act#%d", (v)) \
1827 )
1828 #define PRINT_MESHPATH_ACTION(v) (\
1829 (v) == 0 ? printf("Request") : \
1830 (v) == 1 ? printf("Report") : \
1831 (v) == 2 ? printf("Error") : \
1832 (v) == 3 ? printf("RootAnnouncement") : \
1833 printf("Act#%d", (v)) \
1834 )
1835
1836 #define PRINT_MESH_ACTION(v) (\
1837 (v) == 0 ? printf("MeshLink") : \
1838 (v) == 1 ? printf("HWMP") : \
1839 (v) == 2 ? printf("Gate Announcement") : \
1840 (v) == 3 ? printf("Congestion Control") : \
1841 (v) == 4 ? printf("MCCA Setup Request") : \
1842 (v) == 5 ? printf("MCCA Setup Reply") : \
1843 (v) == 6 ? printf("MCCA Advertisement Request") : \
1844 (v) == 7 ? printf("MCCA Advertisement") : \
1845 (v) == 8 ? printf("MCCA Teardown") : \
1846 (v) == 9 ? printf("TBTT Adjustment Request") : \
1847 (v) == 10 ? printf("TBTT Adjustment Response") : \
1848 printf("Act#%d", (v)) \
1849 )
1850 #define PRINT_MULTIHOP_ACTION(v) (\
1851 (v) == 0 ? printf("Proxy Update") : \
1852 (v) == 1 ? printf("Proxy Update Confirmation") : \
1853 printf("Act#%d", (v)) \
1854 )
1855 #define PRINT_SELFPROT_ACTION(v) (\
1856 (v) == 1 ? printf("Peering Open") : \
1857 (v) == 2 ? printf("Peering Confirm") : \
1858 (v) == 3 ? printf("Peering Close") : \
1859 (v) == 4 ? printf("Group Key Inform") : \
1860 (v) == 5 ? printf("Group Key Acknowledge") : \
1861 printf("Act#%d", (v)) \
1862 )
1863
1864 static int
1865 handle_action(const struct mgmt_header_t *pmh, const u_char *p, u_int length)
1866 {
1867 if (!TTEST2(*p, 2))
1868 return 0;
1869 if (length < 2)
1870 return 0;
1871 if (eflag) {
1872 printf(": ");
1873 } else {
1874 printf(" (%s): ", etheraddr_string(pmh->sa));
1875 }
1876 switch (p[0]) {
1877 case 0: printf("Spectrum Management Act#%d", p[1]); break;
1878 case 1: printf("QoS Act#%d", p[1]); break;
1879 case 2: printf("DLS Act#%d", p[1]); break;
1880 case 3: printf("BA "); PRINT_BA_ACTION(p[1]); break;
1881 case 7: printf("HT "); PRINT_HT_ACTION(p[1]); break;
1882 case 13: printf("MeshAction "); PRINT_MESH_ACTION(p[1]); break;
1883 case 14:
1884 printf("MultiohopAction ");
1885 PRINT_MULTIHOP_ACTION(p[1]); break;
1886 case 15:
1887 printf("SelfprotectAction ");
1888 PRINT_SELFPROT_ACTION(p[1]); break;
1889 case 127: printf("Vendor Act#%d", p[1]); break;
1890 default:
1891 printf("Reserved(%d) Act#%d", p[0], p[1]);
1892 break;
1893 }
1894 return 1;
1895 }
1896
1897
1898 /*********************************************************************************
1899 * Print Body funcs
1900 *********************************************************************************/
1901
1902
1903 static int
1904 mgmt_body_print(u_int16_t fc, const struct mgmt_header_t *pmh,
1905 const u_char *p, u_int length)
1906 {
1907 switch (FC_SUBTYPE(fc)) {
1908 case ST_ASSOC_REQUEST:
1909 printf("Assoc Request");
1910 return handle_assoc_request(p, length);
1911 case ST_ASSOC_RESPONSE:
1912 printf("Assoc Response");
1913 return handle_assoc_response(p, length);
1914 case ST_REASSOC_REQUEST:
1915 printf("ReAssoc Request");
1916 return handle_reassoc_request(p, length);
1917 case ST_REASSOC_RESPONSE:
1918 printf("ReAssoc Response");
1919 return handle_reassoc_response(p, length);
1920 case ST_PROBE_REQUEST:
1921 printf("Probe Request");
1922 return handle_probe_request(p, length);
1923 case ST_PROBE_RESPONSE:
1924 printf("Probe Response");
1925 return handle_probe_response(p, length);
1926 case ST_BEACON:
1927 printf("Beacon");
1928 return handle_beacon(p, length);
1929 case ST_ATIM:
1930 printf("ATIM");
1931 return handle_atim();
1932 case ST_DISASSOC:
1933 printf("Disassociation");
1934 return handle_disassoc(p, length);
1935 case ST_AUTH:
1936 printf("Authentication");
1937 if (!TTEST2(*p, 3))
1938 return 0;
1939 if ((p[0] == 0 ) && (p[1] == 0) && (p[2] == 0)) {
1940 printf("Authentication (Shared-Key)-3 ");
1941 return wep_print(p);
1942 }
1943 return handle_auth(p, length);
1944 case ST_DEAUTH:
1945 printf("DeAuthentication");
1946 return handle_deauth(pmh, p, length);
1947 break;
1948 case ST_ACTION:
1949 printf("Action");
1950 return handle_action(pmh, p, length);
1951 break;
1952 default:
1953 printf("Unhandled Management subtype(%x)",
1954 FC_SUBTYPE(fc));
1955 return 1;
1956 }
1957 }
1958
1959
1960 /*********************************************************************************
1961 * Handles printing all the control frame types
1962 *********************************************************************************/
1963
1964 static int
1965 ctrl_body_print(u_int16_t fc, const u_char *p)
1966 {
1967 switch (FC_SUBTYPE(fc)) {
1968 case CTRL_CONTROL_WRAPPER:
1969 printf("Control Wrapper");
1970 /* XXX - requires special handling */
1971 break;
1972 case CTRL_BAR:
1973 printf("BAR");
1974 if (!TTEST2(*p, CTRL_BAR_HDRLEN))
1975 return 0;
1976 if (!eflag)
1977 printf(" RA:%s TA:%s CTL(%x) SEQ(%u) ",
1978 etheraddr_string(((const struct ctrl_bar_t *)p)->ra),
1979 etheraddr_string(((const struct ctrl_bar_t *)p)->ta),
1980 EXTRACT_LE_16BITS(&(((const struct ctrl_bar_t *)p)->ctl)),
1981 EXTRACT_LE_16BITS(&(((const struct ctrl_bar_t *)p)->seq)));
1982 break;
1983 case CTRL_BA:
1984 printf("BA");
1985 if (!TTEST2(*p, CTRL_BA_HDRLEN))
1986 return 0;
1987 if (!eflag)
1988 printf(" RA:%s ",
1989 etheraddr_string(((const struct ctrl_ba_t *)p)->ra));
1990 break;
1991 case CTRL_PS_POLL:
1992 printf("Power Save-Poll");
1993 if (!TTEST2(*p, CTRL_PS_POLL_HDRLEN))
1994 return 0;
1995 printf(" AID(%x)",
1996 EXTRACT_LE_16BITS(&(((const struct ctrl_ps_poll_t *)p)->aid)));
1997 break;
1998 case CTRL_RTS:
1999 printf("Request-To-Send");
2000 if (!TTEST2(*p, CTRL_RTS_HDRLEN))
2001 return 0;
2002 if (!eflag)
2003 printf(" TA:%s ",
2004 etheraddr_string(((const struct ctrl_rts_t *)p)->ta));
2005 break;
2006 case CTRL_CTS:
2007 printf("Clear-To-Send");
2008 if (!TTEST2(*p, CTRL_CTS_HDRLEN))
2009 return 0;
2010 if (!eflag)
2011 printf(" RA:%s ",
2012 etheraddr_string(((const struct ctrl_cts_t *)p)->ra));
2013 break;
2014 case CTRL_ACK:
2015 printf("Acknowledgment");
2016 if (!TTEST2(*p, CTRL_ACK_HDRLEN))
2017 return 0;
2018 if (!eflag)
2019 printf(" RA:%s ",
2020 etheraddr_string(((const struct ctrl_ack_t *)p)->ra));
2021 break;
2022 case CTRL_CF_END:
2023 printf("CF-End");
2024 if (!TTEST2(*p, CTRL_END_HDRLEN))
2025 return 0;
2026 if (!eflag)
2027 printf(" RA:%s ",
2028 etheraddr_string(((const struct ctrl_end_t *)p)->ra));
2029 break;
2030 case CTRL_END_ACK:
2031 printf("CF-End+CF-Ack");
2032 if (!TTEST2(*p, CTRL_END_ACK_HDRLEN))
2033 return 0;
2034 if (!eflag)
2035 printf(" RA:%s ",
2036 etheraddr_string(((const struct ctrl_end_ack_t *)p)->ra));
2037 break;
2038 default:
2039 printf("Unknown Ctrl Subtype");
2040 }
2041 return 1;
2042 }
2043
2044 /*
2045 * Print Header funcs
2046 */
2047
2048 /*
2049 * Data Frame - Address field contents
2050 *
2051 * To Ds | From DS | Addr 1 | Addr 2 | Addr 3 | Addr 4
2052 * 0 | 0 | DA | SA | BSSID | n/a
2053 * 0 | 1 | DA | BSSID | SA | n/a
2054 * 1 | 0 | BSSID | SA | DA | n/a
2055 * 1 | 1 | RA | TA | DA | SA
2056 */
2057
2058 static void
2059 data_header_print(u_int16_t fc, const u_char *p, const u_int8_t **srcp,
2060 const u_int8_t **dstp)
2061 {
2062 u_int subtype = FC_SUBTYPE(fc);
2063
2064 if (DATA_FRAME_IS_CF_ACK(subtype) || DATA_FRAME_IS_CF_POLL(subtype) ||
2065 DATA_FRAME_IS_QOS(subtype)) {
2066 printf("CF ");
2067 if (DATA_FRAME_IS_CF_ACK(subtype)) {
2068 if (DATA_FRAME_IS_CF_POLL(subtype))
2069 printf("Ack/Poll");
2070 else
2071 printf("Ack");
2072 } else {
2073 if (DATA_FRAME_IS_CF_POLL(subtype))
2074 printf("Poll");
2075 }
2076 if (DATA_FRAME_IS_QOS(subtype))
2077 printf("+QoS");
2078 printf(" ");
2079 }
2080
2081 #define ADDR1 (p + 4)
2082 #define ADDR2 (p + 10)
2083 #define ADDR3 (p + 16)
2084 #define ADDR4 (p + 24)
2085
2086 if (!FC_TO_DS(fc) && !FC_FROM_DS(fc)) {
2087 if (srcp != NULL)
2088 *srcp = ADDR2;
2089 if (dstp != NULL)
2090 *dstp = ADDR1;
2091 if (!eflag)
2092 return;
2093 printf("DA:%s SA:%s BSSID:%s ",
2094 etheraddr_string(ADDR1), etheraddr_string(ADDR2),
2095 etheraddr_string(ADDR3));
2096 } else if (!FC_TO_DS(fc) && FC_FROM_DS(fc)) {
2097 if (srcp != NULL)
2098 *srcp = ADDR3;
2099 if (dstp != NULL)
2100 *dstp = ADDR1;
2101 if (!eflag)
2102 return;
2103 printf("DA:%s BSSID:%s SA:%s ",
2104 etheraddr_string(ADDR1), etheraddr_string(ADDR2),
2105 etheraddr_string(ADDR3));
2106 } else if (FC_TO_DS(fc) && !FC_FROM_DS(fc)) {
2107 if (srcp != NULL)
2108 *srcp = ADDR2;
2109 if (dstp != NULL)
2110 *dstp = ADDR3;
2111 if (!eflag)
2112 return;
2113 printf("BSSID:%s SA:%s DA:%s ",
2114 etheraddr_string(ADDR1), etheraddr_string(ADDR2),
2115 etheraddr_string(ADDR3));
2116 } else if (FC_TO_DS(fc) && FC_FROM_DS(fc)) {
2117 if (srcp != NULL)
2118 *srcp = ADDR4;
2119 if (dstp != NULL)
2120 *dstp = ADDR3;
2121 if (!eflag)
2122 return;
2123 printf("RA:%s TA:%s DA:%s SA:%s ",
2124 etheraddr_string(ADDR1), etheraddr_string(ADDR2),
2125 etheraddr_string(ADDR3), etheraddr_string(ADDR4));
2126 }
2127
2128 #undef ADDR1
2129 #undef ADDR2
2130 #undef ADDR3
2131 #undef ADDR4
2132 }
2133
2134 static void
2135 mgmt_header_print(const u_char *p, const u_int8_t **srcp,
2136 const u_int8_t **dstp)
2137 {
2138 const struct mgmt_header_t *hp = (const struct mgmt_header_t *) p;
2139
2140 if (srcp != NULL)
2141 *srcp = hp->sa;
2142 if (dstp != NULL)
2143 *dstp = hp->da;
2144 if (!eflag)
2145 return;
2146
2147 printf("BSSID:%s DA:%s SA:%s ",
2148 etheraddr_string((hp)->bssid), etheraddr_string((hp)->da),
2149 etheraddr_string((hp)->sa));
2150 }
2151
2152 static void
2153 ctrl_header_print(u_int16_t fc, const u_char *p, const u_int8_t **srcp,
2154 const u_int8_t **dstp)
2155 {
2156 if (srcp != NULL)
2157 *srcp = NULL;
2158 if (dstp != NULL)
2159 *dstp = NULL;
2160 if (!eflag)
2161 return;
2162
2163 switch (FC_SUBTYPE(fc)) {
2164 case CTRL_BAR:
2165 printf(" RA:%s TA:%s CTL(%x) SEQ(%u) ",
2166 etheraddr_string(((const struct ctrl_bar_t *)p)->ra),
2167 etheraddr_string(((const struct ctrl_bar_t *)p)->ta),
2168 EXTRACT_LE_16BITS(&(((const struct ctrl_bar_t *)p)->ctl)),
2169 EXTRACT_LE_16BITS(&(((const struct ctrl_bar_t *)p)->seq)));
2170 break;
2171 case CTRL_BA:
2172 printf("RA:%s ",
2173 etheraddr_string(((const struct ctrl_ba_t *)p)->ra));
2174 break;
2175 case CTRL_PS_POLL:
2176 printf("BSSID:%s TA:%s ",
2177 etheraddr_string(((const struct ctrl_ps_poll_t *)p)->bssid),
2178 etheraddr_string(((const struct ctrl_ps_poll_t *)p)->ta));
2179 break;
2180 case CTRL_RTS:
2181 printf("RA:%s TA:%s ",
2182 etheraddr_string(((const struct ctrl_rts_t *)p)->ra),
2183 etheraddr_string(((const struct ctrl_rts_t *)p)->ta));
2184 break;
2185 case CTRL_CTS:
2186 printf("RA:%s ",
2187 etheraddr_string(((const struct ctrl_cts_t *)p)->ra));
2188 break;
2189 case CTRL_ACK:
2190 printf("RA:%s ",
2191 etheraddr_string(((const struct ctrl_ack_t *)p)->ra));
2192 break;
2193 case CTRL_CF_END:
2194 printf("RA:%s BSSID:%s ",
2195 etheraddr_string(((const struct ctrl_end_t *)p)->ra),
2196 etheraddr_string(((const struct ctrl_end_t *)p)->bssid));
2197 break;
2198 case CTRL_END_ACK:
2199 printf("RA:%s BSSID:%s ",
2200 etheraddr_string(((const struct ctrl_end_ack_t *)p)->ra),
2201 etheraddr_string(((const struct ctrl_end_ack_t *)p)->bssid));
2202 break;
2203 default:
2204 printf("(H) Unknown Ctrl Subtype");
2205 break;
2206 }
2207 }
2208
2209 static int
2210 extract_header_length(u_int16_t fc)
2211 {
2212 int len;
2213
2214 switch (FC_TYPE(fc)) {
2215 case T_MGMT:
2216 return MGMT_HDRLEN;
2217 case T_CTRL:
2218 switch (FC_SUBTYPE(fc)) {
2219 case CTRL_BAR:
2220 return CTRL_BAR_HDRLEN;
2221 case CTRL_PS_POLL:
2222 return CTRL_PS_POLL_HDRLEN;
2223 case CTRL_RTS:
2224 return CTRL_RTS_HDRLEN;
2225 case CTRL_CTS:
2226 return CTRL_CTS_HDRLEN;
2227 case CTRL_ACK:
2228 return CTRL_ACK_HDRLEN;
2229 case CTRL_CF_END:
2230 return CTRL_END_HDRLEN;
2231 case CTRL_END_ACK:
2232 return CTRL_END_ACK_HDRLEN;
2233 default:
2234 return 0;
2235 }
2236 case T_DATA:
2237 len = (FC_TO_DS(fc) && FC_FROM_DS(fc)) ? 30 : 24;
2238 if (DATA_FRAME_IS_QOS(FC_SUBTYPE(fc)))
2239 len += 2;
2240 return len;
2241 default:
2242 printf("unknown IEEE802.11 frame type (%d)", FC_TYPE(fc));
2243 return 0;
2244 }
2245 }
2246
2247 static int
2248 extract_mesh_header_length(const u_char *p)
2249 {
2250 return (p[0] &~ 3) ? 0 : 6*(1 + (p[0] & 3));
2251 }
2252
2253 /*
2254 * Print the 802.11 MAC header if eflag is set, and set "*srcp" and "*dstp"
2255 * to point to the source and destination MAC addresses in any case if
2256 * "srcp" and "dstp" aren't null.
2257 */
2258 static void
2259 ieee_802_11_hdr_print(u_int16_t fc, const u_char *p, u_int hdrlen,
2260 u_int meshdrlen, const u_int8_t **srcp, const u_int8_t **dstp)
2261 {
2262 if (vflag) {
2263 if (FC_MORE_DATA(fc))
2264 printf("More Data ");
2265 if (FC_MORE_FLAG(fc))
2266 printf("More Fragments ");
2267 if (FC_POWER_MGMT(fc))
2268 printf("Pwr Mgmt ");
2269 if (FC_RETRY(fc))
2270 printf("Retry ");
2271 if (FC_ORDER(fc))
2272 printf("Strictly Ordered ");
2273 if (FC_WEP(fc))
2274 printf("WEP Encrypted ");
2275 if (FC_TYPE(fc) != T_CTRL || FC_SUBTYPE(fc) != CTRL_PS_POLL)
2276 printf("%dus ",
2277 EXTRACT_LE_16BITS(
2278 &((const struct mgmt_header_t *)p)->duration));
2279 }
2280 if (meshdrlen != 0) {
2281 const struct meshcntl_t *mc =
2282 (const struct meshcntl_t *)&p[hdrlen - meshdrlen];
2283 int ae = mc->flags & 3;
2284
2285 printf("MeshData (AE %d TTL %u seq %u", ae, mc->ttl,
2286 EXTRACT_LE_32BITS(mc->seq));
2287 if (ae > 0)
2288 printf(" A4:%s", etheraddr_string(mc->addr4));
2289 if (ae > 1)
2290 printf(" A5:%s", etheraddr_string(mc->addr5));
2291 if (ae > 2)
2292 printf(" A6:%s", etheraddr_string(mc->addr6));
2293 printf(") ");
2294 }
2295
2296 switch (FC_TYPE(fc)) {
2297 case T_MGMT:
2298 mgmt_header_print(p, srcp, dstp);
2299 break;
2300 case T_CTRL:
2301 ctrl_header_print(fc, p, srcp, dstp);
2302 break;
2303 case T_DATA:
2304 data_header_print(fc, p, srcp, dstp);
2305 break;
2306 default:
2307 printf("(header) unknown IEEE802.11 frame type (%d)",
2308 FC_TYPE(fc));
2309 *srcp = NULL;
2310 *dstp = NULL;
2311 break;
2312 }
2313 }
2314
2315 #ifndef roundup2
2316 #define roundup2(x, y) (((x)+((y)-1))&(~((y)-1))) /* if y is powers of two */
2317 #endif
2318
2319 static u_int
2320 ieee802_11_print(const u_char *p, u_int length, u_int orig_caplen, int pad,
2321 u_int fcslen)
2322 {
2323 u_int16_t fc;
2324 u_int caplen, hdrlen, meshdrlen;
2325 const u_int8_t *src, *dst;
2326 u_short extracted_ethertype;
2327
2328 caplen = orig_caplen;
2329 /* Remove FCS, if present */
2330 if (length < fcslen) {
2331 printf("%s", tstr);
2332 return caplen;
2333 }
2334 length -= fcslen;
2335 if (caplen > length) {
2336 /* Amount of FCS in actual packet data, if any */
2337 fcslen = caplen - length;
2338 caplen -= fcslen;
2339 snapend -= fcslen;
2340 }
2341
2342 if (caplen < IEEE802_11_FC_LEN) {
2343 printf("%s", tstr);
2344 return orig_caplen;
2345 }
2346
2347 fc = EXTRACT_LE_16BITS(p);
2348 hdrlen = extract_header_length(fc);
2349 if (pad)
2350 hdrlen = roundup2(hdrlen, 4);
2351 if (Hflag && FC_TYPE(fc) == T_DATA &&
2352 DATA_FRAME_IS_QOS(FC_SUBTYPE(fc))) {
2353 meshdrlen = extract_mesh_header_length(p+hdrlen);
2354 hdrlen += meshdrlen;
2355 } else
2356 meshdrlen = 0;
2357
2358
2359 if (caplen < hdrlen) {
2360 printf("%s", tstr);
2361 return hdrlen;
2362 }
2363
2364 ieee_802_11_hdr_print(fc, p, hdrlen, meshdrlen, &src, &dst);
2365
2366 /*
2367 * Go past the 802.11 header.
2368 */
2369 length -= hdrlen;
2370 caplen -= hdrlen;
2371 p += hdrlen;
2372
2373 switch (FC_TYPE(fc)) {
2374 case T_MGMT:
2375 if (!mgmt_body_print(fc,
2376 (const struct mgmt_header_t *)(p - hdrlen), p, length)) {
2377 printf("%s", tstr);
2378 return hdrlen;
2379 }
2380 break;
2381 case T_CTRL:
2382 if (!ctrl_body_print(fc, p - hdrlen)) {
2383 printf("%s", tstr);
2384 return hdrlen;
2385 }
2386 break;
2387 case T_DATA:
2388 if (DATA_FRAME_IS_NULL(FC_SUBTYPE(fc)))
2389 return hdrlen; /* no-data frame */
2390 /* There may be a problem w/ AP not having this bit set */
2391 if (FC_WEP(fc)) {
2392 if (!wep_print(p)) {
2393 printf("%s", tstr);
2394 return hdrlen;
2395 }
2396 } else if (llc_print(p, length, caplen, dst, src,
2397 &extracted_ethertype) == 0) {
2398 /*
2399 * Some kinds of LLC packet we cannot
2400 * handle intelligently
2401 */
2402 if (!eflag)
2403 ieee_802_11_hdr_print(fc, p - hdrlen, hdrlen,
2404 meshdrlen, NULL, NULL);
2405 if (extracted_ethertype)
2406 printf("(LLC %s) ",
2407 etherproto_string(
2408 htons(extracted_ethertype)));
2409 if (!suppress_default_print)
2410 default_print(p, caplen);
2411 }
2412 break;
2413 default:
2414 printf("unknown 802.11 frame type (%d)", FC_TYPE(fc));
2415 break;
2416 }
2417
2418 return hdrlen;
2419 }
2420
2421 /*
2422 * This is the top level routine of the printer. 'p' points
2423 * to the 802.11 header of the packet, 'h->ts' is the timestamp,
2424 * 'h->len' is the length of the packet off the wire, and 'h->caplen'
2425 * is the number of bytes actually captured.
2426 */
2427 u_int
2428 ieee802_11_if_print(const struct pcap_pkthdr *h, const u_char *p)
2429 {
2430 return ieee802_11_print(p, h->len, h->caplen, 0, 0);
2431 }
2432
2433 #define IEEE80211_CHAN_FHSS \
2434 (IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_GFSK)
2435 #define IEEE80211_CHAN_A \
2436 (IEEE80211_CHAN_5GHZ | IEEE80211_CHAN_OFDM)
2437 #define IEEE80211_CHAN_B \
2438 (IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_CCK)
2439 #define IEEE80211_CHAN_PUREG \
2440 (IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_OFDM)
2441 #define IEEE80211_CHAN_G \
2442 (IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_DYN)
2443
2444 #define IS_CHAN_FHSS(flags) \
2445 ((flags & IEEE80211_CHAN_FHSS) == IEEE80211_CHAN_FHSS)
2446 #define IS_CHAN_A(flags) \
2447 ((flags & IEEE80211_CHAN_A) == IEEE80211_CHAN_A)
2448 #define IS_CHAN_B(flags) \
2449 ((flags & IEEE80211_CHAN_B) == IEEE80211_CHAN_B)
2450 #define IS_CHAN_PUREG(flags) \
2451 ((flags & IEEE80211_CHAN_PUREG) == IEEE80211_CHAN_PUREG)
2452 #define IS_CHAN_G(flags) \
2453 ((flags & IEEE80211_CHAN_G) == IEEE80211_CHAN_G)
2454 #define IS_CHAN_ANYG(flags) \
2455 (IS_CHAN_PUREG(flags) || IS_CHAN_G(flags))
2456
2457 static void
2458 print_chaninfo(int freq, int flags)
2459 {
2460 printf("%u MHz", freq);
2461 if (IS_CHAN_FHSS(flags))
2462 printf(" FHSS");
2463 if (IS_CHAN_A(flags)) {
2464 if (flags & IEEE80211_CHAN_HALF)
2465 printf(" 11a/10Mhz");
2466 else if (flags & IEEE80211_CHAN_QUARTER)
2467 printf(" 11a/5Mhz");
2468 else
2469 printf(" 11a");
2470 }
2471 if (IS_CHAN_ANYG(flags)) {
2472 if (flags & IEEE80211_CHAN_HALF)
2473 printf(" 11g/10Mhz");
2474 else if (flags & IEEE80211_CHAN_QUARTER)
2475 printf(" 11g/5Mhz");
2476 else
2477 printf(" 11g");
2478 } else if (IS_CHAN_B(flags))
2479 printf(" 11b");
2480 if (flags & IEEE80211_CHAN_TURBO)
2481 printf(" Turbo");
2482 if (flags & IEEE80211_CHAN_HT20)
2483 printf(" ht/20");
2484 else if (flags & IEEE80211_CHAN_HT40D)
2485 printf(" ht/40-");
2486 else if (flags & IEEE80211_CHAN_HT40U)
2487 printf(" ht/40+");
2488 printf(" ");
2489 }
2490
2491 static int
2492 print_radiotap_field(struct cpack_state *s, u_int32_t bit, u_int8_t *flags,
2493 struct radiotap_state *state, u_int32_t presentflags)
2494 {
2495 union {
2496 int8_t i8;
2497 u_int8_t u8;
2498 int16_t i16;
2499 u_int16_t u16;
2500 u_int32_t u32;
2501 u_int64_t u64;
2502 } u, u2, u3, u4;
2503 int rc;
2504
2505 switch (bit) {
2506 case IEEE80211_RADIOTAP_FLAGS:
2507 rc = cpack_uint8(s, &u.u8);
2508 if (rc != 0)
2509 break;
2510 *flags = u.u8;
2511 break;
2512 case IEEE80211_RADIOTAP_RATE:
2513 rc = cpack_uint8(s, &u.u8);
2514 if (rc != 0)
2515 break;
2516
2517 /* Save state rate */
2518 state->rate = u.u8;
2519 break;
2520 case IEEE80211_RADIOTAP_DB_ANTSIGNAL:
2521 case IEEE80211_RADIOTAP_DB_ANTNOISE:
2522 case IEEE80211_RADIOTAP_ANTENNA:
2523 rc = cpack_uint8(s, &u.u8);
2524 break;
2525 case IEEE80211_RADIOTAP_DBM_ANTSIGNAL:
2526 case IEEE80211_RADIOTAP_DBM_ANTNOISE:
2527 rc = cpack_int8(s, &u.i8);
2528 break;
2529 case IEEE80211_RADIOTAP_CHANNEL:
2530 rc = cpack_uint16(s, &u.u16);
2531 if (rc != 0)
2532 break;
2533 rc = cpack_uint16(s, &u2.u16);
2534 break;
2535 case IEEE80211_RADIOTAP_FHSS:
2536 case IEEE80211_RADIOTAP_LOCK_QUALITY:
2537 case IEEE80211_RADIOTAP_TX_ATTENUATION:
2538 case IEEE80211_RADIOTAP_RX_FLAGS:
2539 rc = cpack_uint16(s, &u.u16);
2540 break;
2541 case IEEE80211_RADIOTAP_DB_TX_ATTENUATION:
2542 rc = cpack_uint8(s, &u.u8);
2543 break;
2544 case IEEE80211_RADIOTAP_DBM_TX_POWER:
2545 rc = cpack_int8(s, &u.i8);
2546 break;
2547 case IEEE80211_RADIOTAP_TSFT:
2548 rc = cpack_uint64(s, &u.u64);
2549 break;
2550 case IEEE80211_RADIOTAP_XCHANNEL:
2551 rc = cpack_uint32(s, &u.u32);
2552 if (rc != 0)
2553 break;
2554 rc = cpack_uint16(s, &u2.u16);
2555 if (rc != 0)
2556 break;
2557 rc = cpack_uint8(s, &u3.u8);
2558 if (rc != 0)
2559 break;
2560 rc = cpack_uint8(s, &u4.u8);
2561 break;
2562 case IEEE80211_RADIOTAP_MCS:
2563 rc = cpack_uint8(s, &u.u8);
2564 if (rc != 0)
2565 break;
2566 rc = cpack_uint8(s, &u2.u8);
2567 if (rc != 0)
2568 break;
2569 rc = cpack_uint8(s, &u3.u8);
2570 break;
2571 case IEEE80211_RADIOTAP_VENDOR_NAMESPACE: {
2572 u_int8_t vns[3];
2573 u_int16_t length;
2574 u_int8_t subspace;
2575
2576 if ((cpack_align_and_reserve(s, 2)) == NULL) {
2577 rc = -1;
2578 break;
2579 }
2580
2581 rc = cpack_uint8(s, &vns[0]);
2582 if (rc != 0)
2583 break;
2584 rc = cpack_uint8(s, &vns[1]);
2585 if (rc != 0)
2586 break;
2587 rc = cpack_uint8(s, &vns[2]);
2588 if (rc != 0)
2589 break;
2590 rc = cpack_uint8(s, &subspace);
2591 if (rc != 0)
2592 break;
2593 rc = cpack_uint16(s, &length);
2594 if (rc != 0)
2595 break;
2596
2597 /* Skip up to length */
2598 s->c_next += length;
2599 break;
2600 }
2601 default:
2602 /* this bit indicates a field whose
2603 * size we do not know, so we cannot
2604 * proceed. Just print the bit number.
2605 */
2606 printf("[bit %u] ", bit);
2607 return -1;
2608 }
2609
2610 if (rc != 0) {
2611 printf("%s", tstr);
2612 return rc;
2613 }
2614
2615 /* Preserve the state present flags */
2616 state->present = presentflags;
2617
2618 switch (bit) {
2619 case IEEE80211_RADIOTAP_CHANNEL:
2620 /*
2621 * If CHANNEL and XCHANNEL are both present, skip
2622 * CHANNEL.
2623 */
2624 if (presentflags & (1 << IEEE80211_RADIOTAP_XCHANNEL))
2625 break;
2626 print_chaninfo(u.u16, u2.u16);
2627 break;
2628 case IEEE80211_RADIOTAP_FHSS:
2629 printf("fhset %d fhpat %d ", u.u16 & 0xff, (u.u16 >> 8) & 0xff);
2630 break;
2631 case IEEE80211_RADIOTAP_RATE:
2632 /*
2633 * XXX On FreeBSD rate & 0x80 means we have an MCS. On
2634 * Linux and AirPcap it does not. (What about
2635 * Mac OS X, NetBSD, OpenBSD, and DragonFly BSD?)
2636 *
2637 * This is an issue either for proprietary extensions
2638 * to 11a or 11g, which do exist, or for 11n
2639 * implementations that stuff a rate value into
2640 * this field, which also appear to exist.
2641 *
2642 * We currently handle that by assuming that
2643 * if the 0x80 bit is set *and* the remaining
2644 * bits have a value between 0 and 15 it's
2645 * an MCS value, otherwise it's a rate. If
2646 * there are cases where systems that use
2647 * "0x80 + MCS index" for MCS indices > 15,
2648 * or stuff a rate value here between 64 and
2649 * 71.5 Mb/s in here, we'll need a preference
2650 * setting. Such rates do exist, e.g. 11n
2651 * MCS 7 at 20 MHz with a long guard interval.
2652 */
2653 if (u.u8 >= 0x80 && u.u8 <= 0x8f) {
2654 /*
2655 * XXX - we don't know the channel width
2656 * or guard interval length, so we can't
2657 * convert this to a data rate.
2658 *
2659 * If you want us to show a data rate,
2660 * use the MCS field, not the Rate field;
2661 * the MCS field includes not only the
2662 * MCS index, it also includes bandwidth
2663 * and guard interval information.
2664 *
2665 * XXX - can we get the channel width
2666 * from XChannel and the guard interval
2667 * information from Flags, at least on
2668 * FreeBSD?
2669 */
2670 printf("MCS %u ", u.u8 & 0x7f);
2671 } else
2672 printf("%2.1f Mb/s ", .5*u.u8);
2673 break;
2674 case IEEE80211_RADIOTAP_DBM_ANTSIGNAL:
2675 printf("%ddB signal ", u.i8);
2676 break;
2677 case IEEE80211_RADIOTAP_DBM_ANTNOISE:
2678 printf("%ddB noise ", u.i8);
2679 break;
2680 case IEEE80211_RADIOTAP_DB_ANTSIGNAL:
2681 printf("%ddB signal ", u.u8);
2682 break;
2683 case IEEE80211_RADIOTAP_DB_ANTNOISE:
2684 printf("%ddB noise ", u.u8);
2685 break;
2686 case IEEE80211_RADIOTAP_LOCK_QUALITY:
2687 printf("%u sq ", u.u16);
2688 break;
2689 case IEEE80211_RADIOTAP_TX_ATTENUATION:
2690 printf("%d tx power ", -(int)u.u16);
2691 break;
2692 case IEEE80211_RADIOTAP_DB_TX_ATTENUATION:
2693 printf("%ddB tx power ", -(int)u.u8);
2694 break;
2695 case IEEE80211_RADIOTAP_DBM_TX_POWER:
2696 printf("%ddBm tx power ", u.i8);
2697 break;
2698 case IEEE80211_RADIOTAP_FLAGS:
2699 if (u.u8 & IEEE80211_RADIOTAP_F_CFP)
2700 printf("cfp ");
2701 if (u.u8 & IEEE80211_RADIOTAP_F_SHORTPRE)
2702 printf("short preamble ");
2703 if (u.u8 & IEEE80211_RADIOTAP_F_WEP)
2704 printf("wep ");
2705 if (u.u8 & IEEE80211_RADIOTAP_F_FRAG)
2706 printf("fragmented ");
2707 if (u.u8 & IEEE80211_RADIOTAP_F_BADFCS)
2708 printf("bad-fcs ");
2709 break;
2710 case IEEE80211_RADIOTAP_ANTENNA:
2711 printf("antenna %d ", u.u8);
2712 break;
2713 case IEEE80211_RADIOTAP_TSFT:
2714 printf("%" PRIu64 "us tsft ", u.u64);
2715 break;
2716 case IEEE80211_RADIOTAP_RX_FLAGS:
2717 /* Do nothing for now */
2718 break;
2719 case IEEE80211_RADIOTAP_XCHANNEL:
2720 print_chaninfo(u2.u16, u.u32);
2721 break;
2722 case IEEE80211_RADIOTAP_MCS: {
2723 static const char *bandwidth[4] = {
2724 "20 MHz",
2725 "40 MHz",
2726 "20 MHz (L)",
2727 "20 MHz (U)"
2728 };
2729 float htrate;
2730
2731 if (u.u8 & IEEE80211_RADIOTAP_MCS_MCS_INDEX_KNOWN) {
2732 /*
2733 * We know the MCS index.
2734 */
2735 if (u3.u8 <= MAX_MCS_INDEX) {
2736 /*
2737 * And it's in-range.
2738 */
2739 if (u.u8 & (IEEE80211_RADIOTAP_MCS_BANDWIDTH_KNOWN|IEEE80211_RADIOTAP_MCS_GUARD_INTERVAL_KNOWN)) {
2740 /*
2741 * And we know both the bandwidth and
2742 * the guard interval, so we can look
2743 * up the rate.
2744 */
2745 htrate =
2746 ieee80211_float_htrates \
2747 [u3.u8] \
2748 [((u2.u8 & IEEE80211_RADIOTAP_MCS_BANDWIDTH_MASK) == IEEE80211_RADIOTAP_MCS_BANDWIDTH_40 ? 1 : 0)] \
2749 [((u2.u8 & IEEE80211_RADIOTAP_MCS_SHORT_GI) ? 1 : 0)];
2750 } else {
2751 /*
2752 * We don't know both the bandwidth
2753 * and the guard interval, so we can
2754 * only report the MCS index.
2755 */
2756 htrate = 0.0;
2757 }
2758 } else {
2759 /*
2760 * The MCS value is out of range.
2761 */
2762 htrate = 0.0;
2763 }
2764 if (htrate != 0.0) {
2765 /*
2766 * We have the rate.
2767 * Print it.
2768 */
2769 printf("%.1f Mb/s MCS %u ", htrate, u3.u8);
2770 } else {
2771 /*
2772 * We at least have the MCS index.
2773 * Print it.
2774 */
2775 printf("MCS %u ", u3.u8);
2776 }
2777 }
2778 if (u.u8 & IEEE80211_RADIOTAP_MCS_BANDWIDTH_KNOWN) {
2779 printf("%s ",
2780 bandwidth[u2.u8 & IEEE80211_RADIOTAP_MCS_BANDWIDTH_MASK]);
2781 }
2782 if (u.u8 & IEEE80211_RADIOTAP_MCS_GUARD_INTERVAL_KNOWN) {
2783 printf("%s GI ",
2784 (u2.u8 & IEEE80211_RADIOTAP_MCS_SHORT_GI) ?
2785 "short" : "lon");
2786 }
2787 if (u.u8 & IEEE80211_RADIOTAP_MCS_HT_FORMAT_KNOWN) {
2788 printf("%s ",
2789 (u2.u8 & IEEE80211_RADIOTAP_MCS_HT_GREENFIELD) ?
2790 "greenfield" : "mixed");
2791 }
2792 if (u.u8 & IEEE80211_RADIOTAP_MCS_FEC_TYPE_KNOWN) {
2793 printf("%s FEC ",
2794 (u2.u8 & IEEE80211_RADIOTAP_MCS_FEC_LDPC) ?
2795 "LDPC" : "BCC");
2796 }
2797 if (u.u8 & IEEE80211_RADIOTAP_MCS_STBC_KNOWN) {
2798 printf("RX-STBC%u ",
2799 (u2.u8 & IEEE80211_RADIOTAP_MCS_STBC_MASK) >> IEEE80211_RADIOTAP_MCS_STBC_SHIFT);
2800 }
2801
2802 break;
2803 }
2804 }
2805 return 0;
2806 }
2807
2808 static u_int
2809 ieee802_11_radio_print(const u_char *p, u_int length, u_int caplen)
2810 {
2811 #define BITNO_32(x) (((x) >> 16) ? 16 + BITNO_16((x) >> 16) : BITNO_16((x)))
2812 #define BITNO_16(x) (((x) >> 8) ? 8 + BITNO_8((x) >> 8) : BITNO_8((x)))
2813 #define BITNO_8(x) (((x) >> 4) ? 4 + BITNO_4((x) >> 4) : BITNO_4((x)))
2814 #define BITNO_4(x) (((x) >> 2) ? 2 + BITNO_2((x) >> 2) : BITNO_2((x)))
2815 #define BITNO_2(x) (((x) & 2) ? 1 : 0)
2816 #define BIT(n) (1U << n)
2817 #define IS_EXTENDED(__p) \
2818 (EXTRACT_LE_32BITS(__p) & BIT(IEEE80211_RADIOTAP_EXT)) != 0
2819
2820 struct cpack_state cpacker;
2821 struct ieee80211_radiotap_header *hdr;
2822 u_int32_t present, next_present;
2823 u_int32_t presentflags = 0;
2824 u_int32_t *presentp, *last_presentp;
2825 enum ieee80211_radiotap_type bit;
2826 int bit0;
2827 u_int len;
2828 u_int8_t flags;
2829 int pad;
2830 u_int fcslen;
2831 struct radiotap_state state;
2832
2833 if (caplen < sizeof(*hdr)) {
2834 printf("%s", tstr);
2835 return caplen;
2836 }
2837
2838 hdr = (struct ieee80211_radiotap_header *)p;
2839
2840 len = EXTRACT_LE_16BITS(&hdr->it_len);
2841
2842 if (caplen < len) {
2843 printf("%s", tstr);
2844 return caplen;
2845 }
2846 cpack_init(&cpacker, (u_int8_t *)hdr, len); /* align against header start */
2847 cpack_advance(&cpacker, sizeof(*hdr)); /* includes the 1st bitmap */
2848 for (last_presentp = &hdr->it_present;
2849 IS_EXTENDED(last_presentp) &&
2850 (u_char*)(last_presentp + 1) <= p + len;
2851 last_presentp++)
2852 cpack_advance(&cpacker, sizeof(hdr->it_present)); /* more bitmaps */
2853
2854 /* are there more bitmap extensions than bytes in header? */
2855 if (IS_EXTENDED(last_presentp)) {
2856 printf("%s", tstr);
2857 return caplen;
2858 }
2859
2860 /* Assume no flags */
2861 flags = 0;
2862 /* Assume no Atheros padding between 802.11 header and body */
2863 pad = 0;
2864 /* Assume no FCS at end of frame */
2865 fcslen = 0;
2866 for (bit0 = 0, presentp = &hdr->it_present; presentp <= last_presentp;
2867 presentp++, bit0 += 32) {
2868 presentflags = EXTRACT_LE_32BITS(presentp);
2869
2870 /* Clear state. */
2871 memset(&state, 0, sizeof(state));
2872
2873 for (present = EXTRACT_LE_32BITS(presentp); present;
2874 present = next_present) {
2875 /* clear the least significant bit that is set */
2876 next_present = present & (present - 1);
2877
2878 /* extract the least significant bit that is set */
2879 bit = (enum ieee80211_radiotap_type)
2880 (bit0 + BITNO_32(present ^ next_present));
2881
2882 if (print_radiotap_field(&cpacker, bit, &flags, &state, presentflags) != 0)
2883 goto out;
2884 }
2885 }
2886
2887 out:
2888 if (flags & IEEE80211_RADIOTAP_F_DATAPAD)
2889 pad = 1; /* Atheros padding */
2890 if (flags & IEEE80211_RADIOTAP_F_FCS)
2891 fcslen = 4; /* FCS at end of packet */
2892 return len + ieee802_11_print(p + len, length - len, caplen - len, pad,
2893 fcslen);
2894 #undef BITNO_32
2895 #undef BITNO_16
2896 #undef BITNO_8
2897 #undef BITNO_4
2898 #undef BITNO_2
2899 #undef BIT
2900 }
2901
2902 static u_int
2903 ieee802_11_avs_radio_print(const u_char *p, u_int length, u_int caplen)
2904 {
2905 u_int32_t caphdr_len;
2906
2907 if (caplen < 8) {
2908 printf("%s", tstr);
2909 return caplen;
2910 }
2911
2912 caphdr_len = EXTRACT_32BITS(p + 4);
2913 if (caphdr_len < 8) {
2914 /*
2915 * Yow! The capture header length is claimed not
2916 * to be large enough to include even the version
2917 * cookie or capture header length!
2918 */
2919 printf("%s", tstr);
2920 return caplen;
2921 }
2922
2923 if (caplen < caphdr_len) {
2924 printf("%s", tstr);
2925 return caplen;
2926 }
2927
2928 return caphdr_len + ieee802_11_print(p + caphdr_len,
2929 length - caphdr_len, caplen - caphdr_len, 0, 0);
2930 }
2931
2932 #define PRISM_HDR_LEN 144
2933
2934 #define WLANCAP_MAGIC_COOKIE_BASE 0x80211000
2935 #define WLANCAP_MAGIC_COOKIE_V1 0x80211001
2936 #define WLANCAP_MAGIC_COOKIE_V2 0x80211002
2937
2938 /*
2939 * For DLT_PRISM_HEADER; like DLT_IEEE802_11, but with an extra header,
2940 * containing information such as radio information, which we
2941 * currently ignore.
2942 *
2943 * If, however, the packet begins with WLANCAP_MAGIC_COOKIE_V1 or
2944 * WLANCAP_MAGIC_COOKIE_V2, it's really DLT_IEEE802_11_RADIO_AVS
2945 * (currently, on Linux, there's no ARPHRD_ type for
2946 * DLT_IEEE802_11_RADIO_AVS, as there is a ARPHRD_IEEE80211_PRISM
2947 * for DLT_PRISM_HEADER, so ARPHRD_IEEE80211_PRISM is used for
2948 * the AVS header, and the first 4 bytes of the header are used to
2949 * indicate whether it's a Prism header or an AVS header).
2950 */
2951 u_int
2952 prism_if_print(const struct pcap_pkthdr *h, const u_char *p)
2953 {
2954 u_int caplen = h->caplen;
2955 u_int length = h->len;
2956 u_int32_t msgcode;
2957
2958 if (caplen < 4) {
2959 printf("%s", tstr);
2960 return caplen;
2961 }
2962
2963 msgcode = EXTRACT_32BITS(p);
2964 if (msgcode == WLANCAP_MAGIC_COOKIE_V1 ||
2965 msgcode == WLANCAP_MAGIC_COOKIE_V2)
2966 return ieee802_11_avs_radio_print(p, length, caplen);
2967
2968 if (caplen < PRISM_HDR_LEN) {
2969 printf("%s", tstr);
2970 return caplen;
2971 }
2972
2973 return PRISM_HDR_LEN + ieee802_11_print(p + PRISM_HDR_LEN,
2974 length - PRISM_HDR_LEN, caplen - PRISM_HDR_LEN, 0, 0);
2975 }
2976
2977 /*
2978 * For DLT_IEEE802_11_RADIO; like DLT_IEEE802_11, but with an extra
2979 * header, containing information such as radio information.
2980 */
2981 u_int
2982 ieee802_11_radio_if_print(const struct pcap_pkthdr *h, const u_char *p)
2983 {
2984 return ieee802_11_radio_print(p, h->len, h->caplen);
2985 }
2986
2987 /*
2988 * For DLT_IEEE802_11_RADIO_AVS; like DLT_IEEE802_11, but with an
2989 * extra header, containing information such as radio information,
2990 * which we currently ignore.
2991 */
2992 u_int
2993 ieee802_11_radio_avs_if_print(const struct pcap_pkthdr *h, const u_char *p)
2994 {
2995 return ieee802_11_avs_radio_print(p, h->len, h->caplen);
2996 }
[mirror] the TCPdump network dissector