]> The Tcpdump Group git mirrors - tcpdump/blob - print-802_11.c
projects / tcpdump / blob
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
remove tcpdump's own CVS keywords
[tcpdump] / print-802_11.c
1 /*
2 * Copyright (c) 2001
3 * Fortress Technologies, Inc. All rights reserved.
4 * Charlie Lenahan (clenahan@fortresstech.com)
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that: (1) source code distributions
8 * retain the above copyright notice and this paragraph in its entirety, (2)
9 * distributions including binary code include the above copyright notice and
10 * this paragraph in its entirety in the documentation or other materials
11 * provided with the distribution, and (3) all advertising materials mentioning
12 * features or use of this software display the following acknowledgement:
13 * ``This product includes software developed by the University of California,
14 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
15 * the University nor the names of its contributors may be used to endorse
16 * or promote products derived from this software without specific prior
17 * written permission.
18 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
19 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
20 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
21 */
22
23 #ifdef HAVE_CONFIG_H
24 #include "config.h"
25 #endif
26
27 #include <tcpdump-stdinc.h>
28
29 #include <stdio.h>
30 #include <pcap.h>
31 #include <string.h>
32
33 #include "interface.h"
34 #include "addrtoname.h"
35 #include "ethertype.h"
36
37 #include "extract.h"
38
39 #include "cpack.h"
40
41
42 /* Lengths of 802.11 header components. */
43 #define IEEE802_11_FC_LEN 2
44 #define IEEE802_11_DUR_LEN 2
45 #define IEEE802_11_DA_LEN 6
46 #define IEEE802_11_SA_LEN 6
47 #define IEEE802_11_BSSID_LEN 6
48 #define IEEE802_11_RA_LEN 6
49 #define IEEE802_11_TA_LEN 6
50 #define IEEE802_11_SEQ_LEN 2
51 #define IEEE802_11_CTL_LEN 2
52 #define IEEE802_11_IV_LEN 3
53 #define IEEE802_11_KID_LEN 1
54
55 /* Frame check sequence length. */
56 #define IEEE802_11_FCS_LEN 4
57
58 /* Lengths of beacon components. */
59 #define IEEE802_11_TSTAMP_LEN 8
60 #define IEEE802_11_BCNINT_LEN 2
61 #define IEEE802_11_CAPINFO_LEN 2
62 #define IEEE802_11_LISTENINT_LEN 2
63
64 #define IEEE802_11_AID_LEN 2
65 #define IEEE802_11_STATUS_LEN 2
66 #define IEEE802_11_REASON_LEN 2
67
68 /* Length of previous AP in reassocation frame */
69 #define IEEE802_11_AP_LEN 6
70
71 #define T_MGMT 0x0 /* management */
72 #define T_CTRL 0x1 /* control */
73 #define T_DATA 0x2 /* data */
74 #define T_RESV 0x3 /* reserved */
75
76 #define ST_ASSOC_REQUEST 0x0
77 #define ST_ASSOC_RESPONSE 0x1
78 #define ST_REASSOC_REQUEST 0x2
79 #define ST_REASSOC_RESPONSE 0x3
80 #define ST_PROBE_REQUEST 0x4
81 #define ST_PROBE_RESPONSE 0x5
82 /* RESERVED 0x6 */
83 /* RESERVED 0x7 */
84 #define ST_BEACON 0x8
85 #define ST_ATIM 0x9
86 #define ST_DISASSOC 0xA
87 #define ST_AUTH 0xB
88 #define ST_DEAUTH 0xC
89 #define ST_ACTION 0xD
90 /* RESERVED 0xE */
91 /* RESERVED 0xF */
92
93
94 #define CTRL_CONTROL_WRAPPER 0x7
95 #define CTRL_BAR 0x8
96 #define CTRL_BA 0x9
97 #define CTRL_PS_POLL 0xA
98 #define CTRL_RTS 0xB
99 #define CTRL_CTS 0xC
100 #define CTRL_ACK 0xD
101 #define CTRL_CF_END 0xE
102 #define CTRL_END_ACK 0xF
103
104 #define DATA_DATA 0x0
105 #define DATA_DATA_CF_ACK 0x1
106 #define DATA_DATA_CF_POLL 0x2
107 #define DATA_DATA_CF_ACK_POLL 0x3
108 #define DATA_NODATA 0x4
109 #define DATA_NODATA_CF_ACK 0x5
110 #define DATA_NODATA_CF_POLL 0x6
111 #define DATA_NODATA_CF_ACK_POLL 0x7
112
113 #define DATA_QOS_DATA 0x8
114 #define DATA_QOS_DATA_CF_ACK 0x9
115 #define DATA_QOS_DATA_CF_POLL 0xA
116 #define DATA_QOS_DATA_CF_ACK_POLL 0xB
117 #define DATA_QOS_NODATA 0xC
118 #define DATA_QOS_CF_POLL_NODATA 0xE
119 #define DATA_QOS_CF_ACK_POLL_NODATA 0xF
120
121 /*
122 * The subtype field of a data frame is, in effect, composed of 4 flag
123 * bits - CF-Ack, CF-Poll, Null (means the frame doesn't actually have
124 * any data), and QoS.
125 */
126 #define DATA_FRAME_IS_CF_ACK(x) ((x) & 0x01)
127 #define DATA_FRAME_IS_CF_POLL(x) ((x) & 0x02)
128 #define DATA_FRAME_IS_NULL(x) ((x) & 0x04)
129 #define DATA_FRAME_IS_QOS(x) ((x) & 0x08)
130
131 /*
132 * Bits in the frame control field.
133 */
134 #define FC_VERSION(fc) ((fc) & 0x3)
135 #define FC_TYPE(fc) (((fc) >> 2) & 0x3)
136 #define FC_SUBTYPE(fc) (((fc) >> 4) & 0xF)
137 #define FC_TO_DS(fc) ((fc) & 0x0100)
138 #define FC_FROM_DS(fc) ((fc) & 0x0200)
139 #define FC_MORE_FLAG(fc) ((fc) & 0x0400)
140 #define FC_RETRY(fc) ((fc) & 0x0800)
141 #define FC_POWER_MGMT(fc) ((fc) & 0x1000)
142 #define FC_MORE_DATA(fc) ((fc) & 0x2000)
143 #define FC_WEP(fc) ((fc) & 0x4000)
144 #define FC_ORDER(fc) ((fc) & 0x8000)
145
146 struct mgmt_header_t {
147 u_int16_t fc;
148 u_int16_t duration;
149 u_int8_t da[6];
150 u_int8_t sa[6];
151 u_int8_t bssid[6];
152 u_int16_t seq_ctrl;
153 };
154
155 #define MGMT_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_DUR_LEN+\
156 IEEE802_11_DA_LEN+IEEE802_11_SA_LEN+\
157 IEEE802_11_BSSID_LEN+IEEE802_11_SEQ_LEN)
158
159 #define CAPABILITY_ESS(cap) ((cap) & 0x0001)
160 #define CAPABILITY_IBSS(cap) ((cap) & 0x0002)
161 #define CAPABILITY_CFP(cap) ((cap) & 0x0004)
162 #define CAPABILITY_CFP_REQ(cap) ((cap) & 0x0008)
163 #define CAPABILITY_PRIVACY(cap) ((cap) & 0x0010)
164
165 struct ssid_t {
166 u_int8_t element_id;
167 u_int8_t length;
168 u_char ssid[33]; /* 32 + 1 for null */
169 };
170
171 struct rates_t {
172 u_int8_t element_id;
173 u_int8_t length;
174 u_int8_t rate[16];
175 };
176
177 struct challenge_t {
178 u_int8_t element_id;
179 u_int8_t length;
180 u_int8_t text[254]; /* 1-253 + 1 for null */
181 };
182
183 struct fh_t {
184 u_int8_t element_id;
185 u_int8_t length;
186 u_int16_t dwell_time;
187 u_int8_t hop_set;
188 u_int8_t hop_pattern;
189 u_int8_t hop_index;
190 };
191
192 struct ds_t {
193 u_int8_t element_id;
194 u_int8_t length;
195 u_int8_t channel;
196 };
197
198 struct cf_t {
199 u_int8_t element_id;
200 u_int8_t length;
201 u_int8_t count;
202 u_int8_t period;
203 u_int16_t max_duration;
204 u_int16_t dur_remaing;
205 };
206
207 struct tim_t {
208 u_int8_t element_id;
209 u_int8_t length;
210 u_int8_t count;
211 u_int8_t period;
212 u_int8_t bitmap_control;
213 u_int8_t bitmap[251];
214 };
215
216 #define E_SSID 0
217 #define E_RATES 1
218 #define E_FH 2
219 #define E_DS 3
220 #define E_CF 4
221 #define E_TIM 5
222 #define E_IBSS 6
223 /* reserved 7 */
224 /* reserved 8 */
225 /* reserved 9 */
226 /* reserved 10 */
227 /* reserved 11 */
228 /* reserved 12 */
229 /* reserved 13 */
230 /* reserved 14 */
231 /* reserved 15 */
232 /* reserved 16 */
233
234 #define E_CHALLENGE 16
235 /* reserved 17 */
236 /* reserved 18 */
237 /* reserved 19 */
238 /* reserved 16 */
239 /* reserved 16 */
240
241
242 struct mgmt_body_t {
243 u_int8_t timestamp[IEEE802_11_TSTAMP_LEN];
244 u_int16_t beacon_interval;
245 u_int16_t listen_interval;
246 u_int16_t status_code;
247 u_int16_t aid;
248 u_char ap[IEEE802_11_AP_LEN];
249 u_int16_t reason_code;
250 u_int16_t auth_alg;
251 u_int16_t auth_trans_seq_num;
252 int challenge_present;
253 struct challenge_t challenge;
254 u_int16_t capability_info;
255 int ssid_present;
256 struct ssid_t ssid;
257 int rates_present;
258 struct rates_t rates;
259 int ds_present;
260 struct ds_t ds;
261 int cf_present;
262 struct cf_t cf;
263 int fh_present;
264 struct fh_t fh;
265 int tim_present;
266 struct tim_t tim;
267 };
268
269 struct ctrl_rts_t {
270 u_int16_t fc;
271 u_int16_t duration;
272 u_int8_t ra[6];
273 u_int8_t ta[6];
274 u_int8_t fcs[4];
275 };
276
277 #define CTRL_RTS_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_DUR_LEN+\
278 IEEE802_11_RA_LEN+IEEE802_11_TA_LEN)
279
280 struct ctrl_cts_t {
281 u_int16_t fc;
282 u_int16_t duration;
283 u_int8_t ra[6];
284 u_int8_t fcs[4];
285 };
286
287 #define CTRL_CTS_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_DUR_LEN+IEEE802_11_RA_LEN)
288
289 struct ctrl_ack_t {
290 u_int16_t fc;
291 u_int16_t duration;
292 u_int8_t ra[6];
293 u_int8_t fcs[4];
294 };
295
296 #define CTRL_ACK_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_DUR_LEN+IEEE802_11_RA_LEN)
297
298 struct ctrl_ps_poll_t {
299 u_int16_t fc;
300 u_int16_t aid;
301 u_int8_t bssid[6];
302 u_int8_t ta[6];
303 u_int8_t fcs[4];
304 };
305
306 #define CTRL_PS_POLL_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_AID_LEN+\
307 IEEE802_11_BSSID_LEN+IEEE802_11_TA_LEN)
308
309 struct ctrl_end_t {
310 u_int16_t fc;
311 u_int16_t duration;
312 u_int8_t ra[6];
313 u_int8_t bssid[6];
314 u_int8_t fcs[4];
315 };
316
317 #define CTRL_END_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_DUR_LEN+\
318 IEEE802_11_RA_LEN+IEEE802_11_BSSID_LEN)
319
320 struct ctrl_end_ack_t {
321 u_int16_t fc;
322 u_int16_t duration;
323 u_int8_t ra[6];
324 u_int8_t bssid[6];
325 u_int8_t fcs[4];
326 };
327
328 #define CTRL_END_ACK_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_DUR_LEN+\
329 IEEE802_11_RA_LEN+IEEE802_11_BSSID_LEN)
330
331 struct ctrl_ba_t {
332 u_int16_t fc;
333 u_int16_t duration;
334 u_int8_t ra[6];
335 u_int8_t fcs[4];
336 };
337
338 #define CTRL_BA_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_DUR_LEN+IEEE802_11_RA_LEN)
339
340 struct ctrl_bar_t {
341 u_int16_t fc;
342 u_int16_t dur;
343 u_int8_t ra[6];
344 u_int8_t ta[6];
345 u_int16_t ctl;
346 u_int16_t seq;
347 u_int8_t fcs[4];
348 };
349
350 #define CTRL_BAR_HDRLEN (IEEE802_11_FC_LEN+IEEE802_11_DUR_LEN+\
351 IEEE802_11_RA_LEN+IEEE802_11_TA_LEN+\
352 IEEE802_11_CTL_LEN+IEEE802_11_SEQ_LEN)
353
354 struct meshcntl_t {
355 u_int8_t flags;
356 u_int8_t ttl;
357 u_int8_t seq[4];
358 u_int8_t addr4[6];
359 u_int8_t addr5[6];
360 u_int8_t addr6[6];
361 };
362
363 #define IV_IV(iv) ((iv) & 0xFFFFFF)
364 #define IV_PAD(iv) (((iv) >> 24) & 0x3F)
365 #define IV_KEYID(iv) (((iv) >> 30) & 0x03)
366
367 /* $FreeBSD: src/sys/net80211/ieee80211_radiotap.h,v 1.5 2005/01/22 20:12:05 sam Exp $ */
368 /* NetBSD: ieee802_11_radio.h,v 1.2 2006/02/26 03:04:03 dyoung Exp */
369
370 /*-
371 * Copyright (c) 2003, 2004 David Young. All rights reserved.
372 *
373 * Redistribution and use in source and binary forms, with or without
374 * modification, are permitted provided that the following conditions
375 * are met:
376 * 1. Redistributions of source code must retain the above copyright
377 * notice, this list of conditions and the following disclaimer.
378 * 2. Redistributions in binary form must reproduce the above copyright
379 * notice, this list of conditions and the following disclaimer in the
380 * documentation and/or other materials provided with the distribution.
381 * 3. The name of David Young may not be used to endorse or promote
382 * products derived from this software without specific prior
383 * written permission.
384 *
385 * THIS SOFTWARE IS PROVIDED BY DAVID YOUNG ``AS IS'' AND ANY
386 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
387 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
388 * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL DAVID
389 * YOUNG BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
390 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
391 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
392 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
393 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
394 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
395 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
396 * OF SUCH DAMAGE.
397 */
398
399 /* A generic radio capture format is desirable. It must be
400 * rigidly defined (e.g., units for fields should be given),
401 * and easily extensible.
402 *
403 * The following is an extensible radio capture format. It is
404 * based on a bitmap indicating which fields are present.
405 *
406 * I am trying to describe precisely what the application programmer
407 * should expect in the following, and for that reason I tell the
408 * units and origin of each measurement (where it applies), or else I
409 * use sufficiently weaselly language ("is a monotonically nondecreasing
410 * function of...") that I cannot set false expectations for lawyerly
411 * readers.
412 */
413
414 /*
415 * The radio capture header precedes the 802.11 header.
416 *
417 * Note well: all radiotap fields are little-endian.
418 */
419 struct ieee80211_radiotap_header {
420 u_int8_t it_version; /* Version 0. Only increases
421 * for drastic changes,
422 * introduction of compatible
423 * new fields does not count.
424 */
425 u_int8_t it_pad;
426 u_int16_t it_len; /* length of the whole
427 * header in bytes, including
428 * it_version, it_pad,
429 * it_len, and data fields.
430 */
431 u_int32_t it_present; /* A bitmap telling which
432 * fields are present. Set bit 31
433 * (0x80000000) to extend the
434 * bitmap by another 32 bits.
435 * Additional extensions are made
436 * by setting bit 31.
437 */
438 };
439
440 /* Name Data type Units
441 * ---- --------- -----
442 *
443 * IEEE80211_RADIOTAP_TSFT u_int64_t microseconds
444 *
445 * Value in microseconds of the MAC's 64-bit 802.11 Time
446 * Synchronization Function timer when the first bit of the
447 * MPDU arrived at the MAC. For received frames, only.
448 *
449 * IEEE80211_RADIOTAP_CHANNEL 2 x u_int16_t MHz, bitmap
450 *
451 * Tx/Rx frequency in MHz, followed by flags (see below).
452 * Note that IEEE80211_RADIOTAP_XCHANNEL must be used to
453 * represent an HT channel as there is not enough room in
454 * the flags word.
455 *
456 * IEEE80211_RADIOTAP_FHSS u_int16_t see below
457 *
458 * For frequency-hopping radios, the hop set (first byte)
459 * and pattern (second byte).
460 *
461 * IEEE80211_RADIOTAP_RATE u_int8_t 500kb/s or index
462 *
463 * Tx/Rx data rate. If bit 0x80 is set then it represents an
464 * an MCS index and not an IEEE rate.
465 *
466 * IEEE80211_RADIOTAP_DBM_ANTSIGNAL int8_t decibels from
467 * one milliwatt (dBm)
468 *
469 * RF signal power at the antenna, decibel difference from
470 * one milliwatt.
471 *
472 * IEEE80211_RADIOTAP_DBM_ANTNOISE int8_t decibels from
473 * one milliwatt (dBm)
474 *
475 * RF noise power at the antenna, decibel difference from one
476 * milliwatt.
477 *
478 * IEEE80211_RADIOTAP_DB_ANTSIGNAL u_int8_t decibel (dB)
479 *
480 * RF signal power at the antenna, decibel difference from an
481 * arbitrary, fixed reference.
482 *
483 * IEEE80211_RADIOTAP_DB_ANTNOISE u_int8_t decibel (dB)
484 *
485 * RF noise power at the antenna, decibel difference from an
486 * arbitrary, fixed reference point.
487 *
488 * IEEE80211_RADIOTAP_LOCK_QUALITY u_int16_t unitless
489 *
490 * Quality of Barker code lock. Unitless. Monotonically
491 * nondecreasing with "better" lock strength. Called "Signal
492 * Quality" in datasheets. (Is there a standard way to measure
493 * this?)
494 *
495 * IEEE80211_RADIOTAP_TX_ATTENUATION u_int16_t unitless
496 *
497 * Transmit power expressed as unitless distance from max
498 * power set at factory calibration. 0 is max power.
499 * Monotonically nondecreasing with lower power levels.
500 *
501 * IEEE80211_RADIOTAP_DB_TX_ATTENUATION u_int16_t decibels (dB)
502 *
503 * Transmit power expressed as decibel distance from max power
504 * set at factory calibration. 0 is max power. Monotonically
505 * nondecreasing with lower power levels.
506 *
507 * IEEE80211_RADIOTAP_DBM_TX_POWER int8_t decibels from
508 * one milliwatt (dBm)
509 *
510 * Transmit power expressed as dBm (decibels from a 1 milliwatt
511 * reference). This is the absolute power level measured at
512 * the antenna port.
513 *
514 * IEEE80211_RADIOTAP_FLAGS u_int8_t bitmap
515 *
516 * Properties of transmitted and received frames. See flags
517 * defined below.
518 *
519 * IEEE80211_RADIOTAP_ANTENNA u_int8_t antenna index
520 *
521 * Unitless indication of the Rx/Tx antenna for this packet.
522 * The first antenna is antenna 0.
523 *
524 * IEEE80211_RADIOTAP_RX_FLAGS u_int16_t bitmap
525 *
526 * Properties of received frames. See flags defined below.
527 *
528 * IEEE80211_RADIOTAP_XCHANNEL u_int32_t bitmap
529 * u_int16_t MHz
530 * u_int8_t channel number
531 * u_int8_t .5 dBm
532 *
533 * Extended channel specification: flags (see below) followed by
534 * frequency in MHz, the corresponding IEEE channel number, and
535 * finally the maximum regulatory transmit power cap in .5 dBm
536 * units. This property supersedes IEEE80211_RADIOTAP_CHANNEL
537 * and only one of the two should be present.
538 *
539 * IEEE80211_RADIOTAP_MCS u_int8_t known
540 * u_int8_t flags
541 * u_int8_t mcs
542 *
543 * Bitset indicating which fields have known values, followed
544 * by bitset of flag values, followed by the MCS rate index as
545 * in IEEE 802.11n.
546 *
547 * IEEE80211_RADIOTAP_VENDOR_NAMESPACE
548 * u_int8_t OUI[3]
549 * u_int8_t subspace
550 * u_int16_t length
551 *
552 * The Vendor Namespace Field contains three sub-fields. The first
553 * sub-field is 3 bytes long. It contains the vendor's IEEE 802
554 * Organizationally Unique Identifier (OUI). The fourth byte is a
555 * vendor-specific "namespace selector."
556 *
557 */
558 enum ieee80211_radiotap_type {
559 IEEE80211_RADIOTAP_TSFT = 0,
560 IEEE80211_RADIOTAP_FLAGS = 1,
561 IEEE80211_RADIOTAP_RATE = 2,
562 IEEE80211_RADIOTAP_CHANNEL = 3,
563 IEEE80211_RADIOTAP_FHSS = 4,
564 IEEE80211_RADIOTAP_DBM_ANTSIGNAL = 5,
565 IEEE80211_RADIOTAP_DBM_ANTNOISE = 6,
566 IEEE80211_RADIOTAP_LOCK_QUALITY = 7,
567 IEEE80211_RADIOTAP_TX_ATTENUATION = 8,
568 IEEE80211_RADIOTAP_DB_TX_ATTENUATION = 9,
569 IEEE80211_RADIOTAP_DBM_TX_POWER = 10,
570 IEEE80211_RADIOTAP_ANTENNA = 11,
571 IEEE80211_RADIOTAP_DB_ANTSIGNAL = 12,
572 IEEE80211_RADIOTAP_DB_ANTNOISE = 13,
573 IEEE80211_RADIOTAP_RX_FLAGS = 14,
574 /* NB: gap for netbsd definitions */
575 IEEE80211_RADIOTAP_XCHANNEL = 18,
576 IEEE80211_RADIOTAP_MCS = 19,
577 IEEE80211_RADIOTAP_NAMESPACE = 29,
578 IEEE80211_RADIOTAP_VENDOR_NAMESPACE = 30,
579 IEEE80211_RADIOTAP_EXT = 31
580 };
581
582 /* channel attributes */
583 #define IEEE80211_CHAN_TURBO 0x00010 /* Turbo channel */
584 #define IEEE80211_CHAN_CCK 0x00020 /* CCK channel */
585 #define IEEE80211_CHAN_OFDM 0x00040 /* OFDM channel */
586 #define IEEE80211_CHAN_2GHZ 0x00080 /* 2 GHz spectrum channel. */
587 #define IEEE80211_CHAN_5GHZ 0x00100 /* 5 GHz spectrum channel */
588 #define IEEE80211_CHAN_PASSIVE 0x00200 /* Only passive scan allowed */
589 #define IEEE80211_CHAN_DYN 0x00400 /* Dynamic CCK-OFDM channel */
590 #define IEEE80211_CHAN_GFSK 0x00800 /* GFSK channel (FHSS PHY) */
591 #define IEEE80211_CHAN_GSM 0x01000 /* 900 MHz spectrum channel */
592 #define IEEE80211_CHAN_STURBO 0x02000 /* 11a static turbo channel only */
593 #define IEEE80211_CHAN_HALF 0x04000 /* Half rate channel */
594 #define IEEE80211_CHAN_QUARTER 0x08000 /* Quarter rate channel */
595 #define IEEE80211_CHAN_HT20 0x10000 /* HT 20 channel */
596 #define IEEE80211_CHAN_HT40U 0x20000 /* HT 40 channel w/ ext above */
597 #define IEEE80211_CHAN_HT40D 0x40000 /* HT 40 channel w/ ext below */
598
599 /* Useful combinations of channel characteristics, borrowed from Ethereal */
600 #define IEEE80211_CHAN_A \
601 (IEEE80211_CHAN_5GHZ | IEEE80211_CHAN_OFDM)
602 #define IEEE80211_CHAN_B \
603 (IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_CCK)
604 #define IEEE80211_CHAN_G \
605 (IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_DYN)
606 #define IEEE80211_CHAN_TA \
607 (IEEE80211_CHAN_5GHZ | IEEE80211_CHAN_OFDM | IEEE80211_CHAN_TURBO)
608 #define IEEE80211_CHAN_TG \
609 (IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_DYN | IEEE80211_CHAN_TURBO)
610
611
612 /* For IEEE80211_RADIOTAP_FLAGS */
613 #define IEEE80211_RADIOTAP_F_CFP 0x01 /* sent/received
614 * during CFP
615 */
616 #define IEEE80211_RADIOTAP_F_SHORTPRE 0x02 /* sent/received
617 * with short
618 * preamble
619 */
620 #define IEEE80211_RADIOTAP_F_WEP 0x04 /* sent/received
621 * with WEP encryption
622 */
623 #define IEEE80211_RADIOTAP_F_FRAG 0x08 /* sent/received
624 * with fragmentation
625 */
626 #define IEEE80211_RADIOTAP_F_FCS 0x10 /* frame includes FCS */
627 #define IEEE80211_RADIOTAP_F_DATAPAD 0x20 /* frame has padding between
628 * 802.11 header and payload
629 * (to 32-bit boundary)
630 */
631 #define IEEE80211_RADIOTAP_F_BADFCS 0x40 /* does not pass FCS check */
632
633 /* For IEEE80211_RADIOTAP_RX_FLAGS */
634 #define IEEE80211_RADIOTAP_F_RX_BADFCS 0x0001 /* frame failed crc check */
635 #define IEEE80211_RADIOTAP_F_RX_PLCP_CRC 0x0002 /* frame failed PLCP CRC check */
636
637 /* For IEEE80211_RADIOTAP_MCS known */
638 #define IEEE80211_RADIOTAP_MCS_BANDWIDTH_KNOWN 0x01
639 #define IEEE80211_RADIOTAP_MCS_MCS_INDEX_KNOWN 0x02 /* MCS index field */
640 #define IEEE80211_RADIOTAP_MCS_GUARD_INTERVAL_KNOWN 0x04
641 #define IEEE80211_RADIOTAP_MCS_HT_FORMAT_KNOWN 0x08
642 #define IEEE80211_RADIOTAP_MCS_FEC_TYPE_KNOWN 0x10
643 #define IEEE80211_RADIOTAP_MCS_STBC_KNOWN 0x20
644
645 /* For IEEE80211_RADIOTAP_MCS flags */
646 #define IEEE80211_RADIOTAP_MCS_BANDWIDTH_MASK 0x03
647 #define IEEE80211_RADIOTAP_MCS_BANDWIDTH_20 0
648 #define IEEE80211_RADIOTAP_MCS_BANDWIDTH_40 1
649 #define IEEE80211_RADIOTAP_MCS_BANDWIDTH_20L 2
650 #define IEEE80211_RADIOTAP_MCS_BANDWIDTH_20U 3
651 #define IEEE80211_RADIOTAP_MCS_SHORT_GI 0x04 /* short guard interval */
652 #define IEEE80211_RADIOTAP_MCS_HT_GREENFIELD 0x08
653 #define IEEE80211_RADIOTAP_MCS_FEC_LDPC 0x10
654 #define IEEE80211_RADIOTAP_MCS_STBC_MASK 0x60
655 #define IEEE80211_RADIOTAP_MCS_STBC_1 1
656 #define IEEE80211_RADIOTAP_MCS_STBC_2 2
657 #define IEEE80211_RADIOTAP_MCS_STBC_3 3
658 #define IEEE80211_RADIOTAP_MCS_STBC_SHIFT 5
659
660 static const char tstr[] = "[|802.11]";
661
662 /* Radiotap state */
663 /* This is used to save state when parsing/processing parameters */
664 struct radiotap_state
665 {
666 u_int32_t present;
667
668 u_int8_t rate;
669 };
670
671 #define PRINT_SSID(p) \
672 if (p.ssid_present) { \
673 printf(" ("); \
674 fn_print(p.ssid.ssid, NULL); \
675 printf(")"); \
676 }
677
678 #define PRINT_RATE(_sep, _r, _suf) \
679 printf("%s%2.1f%s", _sep, (.5 * ((_r) & 0x7f)), _suf)
680 #define PRINT_RATES(p) \
681 if (p.rates_present) { \
682 int z; \
683 const char *sep = " ["; \
684 for (z = 0; z < p.rates.length ; z++) { \
685 PRINT_RATE(sep, p.rates.rate[z], \
686 (p.rates.rate[z] & 0x80 ? "*" : "")); \
687 sep = " "; \
688 } \
689 if (p.rates.length != 0) \
690 printf(" Mbit]"); \
691 }
692
693 #define PRINT_DS_CHANNEL(p) \
694 if (p.ds_present) \
695 printf(" CH: %u", p.ds.channel); \
696 printf("%s", \
697 CAPABILITY_PRIVACY(p.capability_info) ? ", PRIVACY" : "" );
698
699 #define MAX_MCS_INDEX 76
700
701 /*
702 * Indices are:
703 *
704 * the MCS index (0-76);
705 *
706 * 0 for 20 MHz, 1 for 40 MHz;
707 *
708 * 0 for a long guard interval, 1 for a short guard interval.
709 */
710 static const float ieee80211_float_htrates[MAX_MCS_INDEX+1][2][2] = {
711 /* MCS 0 */
712 { /* 20 Mhz */ { 6.5, /* SGI */ 7.2, },
713 /* 40 Mhz */ { 13.5, /* SGI */ 15.0, },
714 },
715
716 /* MCS 1 */
717 { /* 20 Mhz */ { 13.0, /* SGI */ 14.4, },
718 /* 40 Mhz */ { 27.0, /* SGI */ 30.0, },
719 },
720
721 /* MCS 2 */
722 { /* 20 Mhz */ { 19.5, /* SGI */ 21.7, },
723 /* 40 Mhz */ { 40.5, /* SGI */ 45.0, },
724 },
725
726 /* MCS 3 */
727 { /* 20 Mhz */ { 26.0, /* SGI */ 28.9, },
728 /* 40 Mhz */ { 54.0, /* SGI */ 60.0, },
729 },
730
731 /* MCS 4 */
732 { /* 20 Mhz */ { 39.0, /* SGI */ 43.3, },
733 /* 40 Mhz */ { 81.0, /* SGI */ 90.0, },
734 },
735
736 /* MCS 5 */
737 { /* 20 Mhz */ { 52.0, /* SGI */ 57.8, },
738 /* 40 Mhz */ { 108.0, /* SGI */ 120.0, },
739 },
740
741 /* MCS 6 */
742 { /* 20 Mhz */ { 58.5, /* SGI */ 65.0, },
743 /* 40 Mhz */ { 121.5, /* SGI */ 135.0, },
744 },
745
746 /* MCS 7 */
747 { /* 20 Mhz */ { 65.0, /* SGI */ 72.2, },
748 /* 40 Mhz */ { 135.0, /* SGI */ 150.0, },
749 },
750
751 /* MCS 8 */
752 { /* 20 Mhz */ { 13.0, /* SGI */ 14.4, },
753 /* 40 Mhz */ { 27.0, /* SGI */ 30.0, },
754 },
755
756 /* MCS 9 */
757 { /* 20 Mhz */ { 26.0, /* SGI */ 28.9, },
758 /* 40 Mhz */ { 54.0, /* SGI */ 60.0, },
759 },
760
761 /* MCS 10 */
762 { /* 20 Mhz */ { 39.0, /* SGI */ 43.3, },
763 /* 40 Mhz */ { 81.0, /* SGI */ 90.0, },
764 },
765
766 /* MCS 11 */
767 { /* 20 Mhz */ { 52.0, /* SGI */ 57.8, },
768 /* 40 Mhz */ { 108.0, /* SGI */ 120.0, },
769 },
770
771 /* MCS 12 */
772 { /* 20 Mhz */ { 78.0, /* SGI */ 86.7, },
773 /* 40 Mhz */ { 162.0, /* SGI */ 180.0, },
774 },
775
776 /* MCS 13 */
777 { /* 20 Mhz */ { 104.0, /* SGI */ 115.6, },
778 /* 40 Mhz */ { 216.0, /* SGI */ 240.0, },
779 },
780
781 /* MCS 14 */
782 { /* 20 Mhz */ { 117.0, /* SGI */ 130.0, },
783 /* 40 Mhz */ { 243.0, /* SGI */ 270.0, },
784 },
785
786 /* MCS 15 */
787 { /* 20 Mhz */ { 130.0, /* SGI */ 144.4, },
788 /* 40 Mhz */ { 270.0, /* SGI */ 300.0, },
789 },
790
791 /* MCS 16 */
792 { /* 20 Mhz */ { 19.5, /* SGI */ 21.7, },
793 /* 40 Mhz */ { 40.5, /* SGI */ 45.0, },
794 },
795
796 /* MCS 17 */
797 { /* 20 Mhz */ { 39.0, /* SGI */ 43.3, },
798 /* 40 Mhz */ { 81.0, /* SGI */ 90.0, },
799 },
800
801 /* MCS 18 */
802 { /* 20 Mhz */ { 58.5, /* SGI */ 65.0, },
803 /* 40 Mhz */ { 121.5, /* SGI */ 135.0, },
804 },
805
806 /* MCS 19 */
807 { /* 20 Mhz */ { 78.0, /* SGI */ 86.7, },
808 /* 40 Mhz */ { 162.0, /* SGI */ 180.0, },
809 },
810
811 /* MCS 20 */
812 { /* 20 Mhz */ { 117.0, /* SGI */ 130.0, },
813 /* 40 Mhz */ { 243.0, /* SGI */ 270.0, },
814 },
815
816 /* MCS 21 */
817 { /* 20 Mhz */ { 156.0, /* SGI */ 173.3, },
818 /* 40 Mhz */ { 324.0, /* SGI */ 360.0, },
819 },
820
821 /* MCS 22 */
822 { /* 20 Mhz */ { 175.5, /* SGI */ 195.0, },
823 /* 40 Mhz */ { 364.5, /* SGI */ 405.0, },
824 },
825
826 /* MCS 23 */
827 { /* 20 Mhz */ { 195.0, /* SGI */ 216.7, },
828 /* 40 Mhz */ { 405.0, /* SGI */ 450.0, },
829 },
830
831 /* MCS 24 */
832 { /* 20 Mhz */ { 26.0, /* SGI */ 28.9, },
833 /* 40 Mhz */ { 54.0, /* SGI */ 60.0, },
834 },
835
836 /* MCS 25 */
837 { /* 20 Mhz */ { 52.0, /* SGI */ 57.8, },
838 /* 40 Mhz */ { 108.0, /* SGI */ 120.0, },
839 },
840
841 /* MCS 26 */
842 { /* 20 Mhz */ { 78.0, /* SGI */ 86.7, },
843 /* 40 Mhz */ { 162.0, /* SGI */ 180.0, },
844 },
845
846 /* MCS 27 */
847 { /* 20 Mhz */ { 104.0, /* SGI */ 115.6, },
848 /* 40 Mhz */ { 216.0, /* SGI */ 240.0, },
849 },
850
851 /* MCS 28 */
852 { /* 20 Mhz */ { 156.0, /* SGI */ 173.3, },
853 /* 40 Mhz */ { 324.0, /* SGI */ 360.0, },
854 },
855
856 /* MCS 29 */
857 { /* 20 Mhz */ { 208.0, /* SGI */ 231.1, },
858 /* 40 Mhz */ { 432.0, /* SGI */ 480.0, },
859 },
860
861 /* MCS 30 */
862 { /* 20 Mhz */ { 234.0, /* SGI */ 260.0, },
863 /* 40 Mhz */ { 486.0, /* SGI */ 540.0, },
864 },
865
866 /* MCS 31 */
867 { /* 20 Mhz */ { 260.0, /* SGI */ 288.9, },
868 /* 40 Mhz */ { 540.0, /* SGI */ 600.0, },
869 },
870
871 /* MCS 32 */
872 { /* 20 Mhz */ { 0.0, /* SGI */ 0.0, }, /* not valid */
873 /* 40 Mhz */ { 6.0, /* SGI */ 6.7, },
874 },
875
876 /* MCS 33 */
877 { /* 20 Mhz */ { 39.0, /* SGI */ 43.3, },
878 /* 40 Mhz */ { 81.0, /* SGI */ 90.0, },
879 },
880
881 /* MCS 34 */
882 { /* 20 Mhz */ { 52.0, /* SGI */ 57.8, },
883 /* 40 Mhz */ { 108.0, /* SGI */ 120.0, },
884 },
885
886 /* MCS 35 */
887 { /* 20 Mhz */ { 65.0, /* SGI */ 72.2, },
888 /* 40 Mhz */ { 135.0, /* SGI */ 150.0, },
889 },
890
891 /* MCS 36 */
892 { /* 20 Mhz */ { 58.5, /* SGI */ 65.0, },
893 /* 40 Mhz */ { 121.5, /* SGI */ 135.0, },
894 },
895
896 /* MCS 37 */
897 { /* 20 Mhz */ { 78.0, /* SGI */ 86.7, },
898 /* 40 Mhz */ { 162.0, /* SGI */ 180.0, },
899 },
900
901 /* MCS 38 */
902 { /* 20 Mhz */ { 97.5, /* SGI */ 108.3, },
903 /* 40 Mhz */ { 202.5, /* SGI */ 225.0, },
904 },
905
906 /* MCS 39 */
907 { /* 20 Mhz */ { 52.0, /* SGI */ 57.8, },
908 /* 40 Mhz */ { 108.0, /* SGI */ 120.0, },
909 },
910
911 /* MCS 40 */
912 { /* 20 Mhz */ { 65.0, /* SGI */ 72.2, },
913 /* 40 Mhz */ { 135.0, /* SGI */ 150.0, },
914 },
915
916 /* MCS 41 */
917 { /* 20 Mhz */ { 65.0, /* SGI */ 72.2, },
918 /* 40 Mhz */ { 135.0, /* SGI */ 150.0, },
919 },
920
921 /* MCS 42 */
922 { /* 20 Mhz */ { 78.0, /* SGI */ 86.7, },
923 /* 40 Mhz */ { 162.0, /* SGI */ 180.0, },
924 },
925
926 /* MCS 43 */
927 { /* 20 Mhz */ { 91.0, /* SGI */ 101.1, },
928 /* 40 Mhz */ { 189.0, /* SGI */ 210.0, },
929 },
930
931 /* MCS 44 */
932 { /* 20 Mhz */ { 91.0, /* SGI */ 101.1, },
933 /* 40 Mhz */ { 189.0, /* SGI */ 210.0, },
934 },
935
936 /* MCS 45 */
937 { /* 20 Mhz */ { 104.0, /* SGI */ 115.6, },
938 /* 40 Mhz */ { 216.0, /* SGI */ 240.0, },
939 },
940
941 /* MCS 46 */
942 { /* 20 Mhz */ { 78.0, /* SGI */ 86.7, },
943 /* 40 Mhz */ { 162.0, /* SGI */ 180.0, },
944 },
945
946 /* MCS 47 */
947 { /* 20 Mhz */ { 97.5, /* SGI */ 108.3, },
948 /* 40 Mhz */ { 202.5, /* SGI */ 225.0, },
949 },
950
951 /* MCS 48 */
952 { /* 20 Mhz */ { 97.5, /* SGI */ 108.3, },
953 /* 40 Mhz */ { 202.5, /* SGI */ 225.0, },
954 },
955
956 /* MCS 49 */
957 { /* 20 Mhz */ { 117.0, /* SGI */ 130.0, },
958 /* 40 Mhz */ { 243.0, /* SGI */ 270.0, },
959 },
960
961 /* MCS 50 */
962 { /* 20 Mhz */ { 136.5, /* SGI */ 151.7, },
963 /* 40 Mhz */ { 283.5, /* SGI */ 315.0, },
964 },
965
966 /* MCS 51 */
967 { /* 20 Mhz */ { 136.5, /* SGI */ 151.7, },
968 /* 40 Mhz */ { 283.5, /* SGI */ 315.0, },
969 },
970
971 /* MCS 52 */
972 { /* 20 Mhz */ { 156.0, /* SGI */ 173.3, },
973 /* 40 Mhz */ { 324.0, /* SGI */ 360.0, },
974 },
975
976 /* MCS 53 */
977 { /* 20 Mhz */ { 65.0, /* SGI */ 72.2, },
978 /* 40 Mhz */ { 135.0, /* SGI */ 150.0, },
979 },
980
981 /* MCS 54 */
982 { /* 20 Mhz */ { 78.0, /* SGI */ 86.7, },
983 /* 40 Mhz */ { 162.0, /* SGI */ 180.0, },
984 },
985
986 /* MCS 55 */
987 { /* 20 Mhz */ { 91.0, /* SGI */ 101.1, },
988 /* 40 Mhz */ { 189.0, /* SGI */ 210.0, },
989 },
990
991 /* MCS 56 */
992 { /* 20 Mhz */ { 78.0, /* SGI */ 86.7, },
993 /* 40 Mhz */ { 162.0, /* SGI */ 180.0, },
994 },
995
996 /* MCS 57 */
997 { /* 20 Mhz */ { 91.0, /* SGI */ 101.1, },
998 /* 40 Mhz */ { 189.0, /* SGI */ 210.0, },
999 },
1000
1001 /* MCS 58 */
1002 { /* 20 Mhz */ { 104.0, /* SGI */ 115.6, },
1003 /* 40 Mhz */ { 216.0, /* SGI */ 240.0, },
1004 },
1005
1006 /* MCS 59 */
1007 { /* 20 Mhz */ { 117.0, /* SGI */ 130.0, },
1008 /* 40 Mhz */ { 243.0, /* SGI */ 270.0, },
1009 },
1010
1011 /* MCS 60 */
1012 { /* 20 Mhz */ { 104.0, /* SGI */ 115.6, },
1013 /* 40 Mhz */ { 216.0, /* SGI */ 240.0, },
1014 },
1015
1016 /* MCS 61 */
1017 { /* 20 Mhz */ { 117.0, /* SGI */ 130.0, },
1018 /* 40 Mhz */ { 243.0, /* SGI */ 270.0, },
1019 },
1020
1021 /* MCS 62 */
1022 { /* 20 Mhz */ { 130.0, /* SGI */ 144.4, },
1023 /* 40 Mhz */ { 270.0, /* SGI */ 300.0, },
1024 },
1025
1026 /* MCS 63 */
1027 { /* 20 Mhz */ { 130.0, /* SGI */ 144.4, },
1028 /* 40 Mhz */ { 270.0, /* SGI */ 300.0, },
1029 },
1030
1031 /* MCS 64 */
1032 { /* 20 Mhz */ { 143.0, /* SGI */ 158.9, },
1033 /* 40 Mhz */ { 297.0, /* SGI */ 330.0, },
1034 },
1035
1036 /* MCS 65 */
1037 { /* 20 Mhz */ { 97.5, /* SGI */ 108.3, },
1038 /* 40 Mhz */ { 202.5, /* SGI */ 225.0, },
1039 },
1040
1041 /* MCS 66 */
1042 { /* 20 Mhz */ { 117.0, /* SGI */ 130.0, },
1043 /* 40 Mhz */ { 243.0, /* SGI */ 270.0, },
1044 },
1045
1046 /* MCS 67 */
1047 { /* 20 Mhz */ { 136.5, /* SGI */ 151.7, },
1048 /* 40 Mhz */ { 283.5, /* SGI */ 315.0, },
1049 },
1050
1051 /* MCS 68 */
1052 { /* 20 Mhz */ { 117.0, /* SGI */ 130.0, },
1053 /* 40 Mhz */ { 243.0, /* SGI */ 270.0, },
1054 },
1055
1056 /* MCS 69 */
1057 { /* 20 Mhz */ { 136.5, /* SGI */ 151.7, },
1058 /* 40 Mhz */ { 283.5, /* SGI */ 315.0, },
1059 },
1060
1061 /* MCS 70 */
1062 { /* 20 Mhz */ { 156.0, /* SGI */ 173.3, },
1063 /* 40 Mhz */ { 324.0, /* SGI */ 360.0, },
1064 },
1065
1066 /* MCS 71 */
1067 { /* 20 Mhz */ { 175.5, /* SGI */ 195.0, },
1068 /* 40 Mhz */ { 364.5, /* SGI */ 405.0, },
1069 },
1070
1071 /* MCS 72 */
1072 { /* 20 Mhz */ { 156.0, /* SGI */ 173.3, },
1073 /* 40 Mhz */ { 324.0, /* SGI */ 360.0, },
1074 },
1075
1076 /* MCS 73 */
1077 { /* 20 Mhz */ { 175.5, /* SGI */ 195.0, },
1078 /* 40 Mhz */ { 364.5, /* SGI */ 405.0, },
1079 },
1080
1081 /* MCS 74 */
1082 { /* 20 Mhz */ { 195.0, /* SGI */ 216.7, },
1083 /* 40 Mhz */ { 405.0, /* SGI */ 450.0, },
1084 },
1085
1086 /* MCS 75 */
1087 { /* 20 Mhz */ { 195.0, /* SGI */ 216.7, },
1088 /* 40 Mhz */ { 405.0, /* SGI */ 450.0, },
1089 },
1090
1091 /* MCS 76 */
1092 { /* 20 Mhz */ { 214.5, /* SGI */ 238.3, },
1093 /* 40 Mhz */ { 445.5, /* SGI */ 495.0, },
1094 },
1095 };
1096
1097 static const char *auth_alg_text[]={"Open System","Shared Key","EAP"};
1098 #define NUM_AUTH_ALGS (sizeof auth_alg_text / sizeof auth_alg_text[0])
1099
1100 static const char *status_text[] = {
1101 "Successful", /* 0 */
1102 "Unspecified failure", /* 1 */
1103 "Reserved", /* 2 */
1104 "Reserved", /* 3 */
1105 "Reserved", /* 4 */
1106 "Reserved", /* 5 */
1107 "Reserved", /* 6 */
1108 "Reserved", /* 7 */
1109 "Reserved", /* 8 */
1110 "Reserved", /* 9 */
1111 "Cannot Support all requested capabilities in the Capability "
1112 "Information field", /* 10 */
1113 "Reassociation denied due to inability to confirm that association "
1114 "exists", /* 11 */
1115 "Association denied due to reason outside the scope of the "
1116 "standard", /* 12 */
1117 "Responding station does not support the specified authentication "
1118 "algorithm ", /* 13 */
1119 "Received an Authentication frame with authentication transaction "
1120 "sequence number out of expected sequence", /* 14 */
1121 "Authentication rejected because of challenge failure", /* 15 */
1122 "Authentication rejected due to timeout waiting for next frame in "
1123 "sequence", /* 16 */
1124 "Association denied because AP is unable to handle additional"
1125 "associated stations", /* 17 */
1126 "Association denied due to requesting station not supporting all of "
1127 "the data rates in BSSBasicRateSet parameter", /* 18 */
1128 "Association denied due to requesting station not supporting "
1129 "short preamble operation", /* 19 */
1130 "Association denied due to requesting station not supporting "
1131 "PBCC encoding", /* 20 */
1132 "Association denied due to requesting station not supporting "
1133 "channel agility", /* 21 */
1134 "Association request rejected because Spectrum Management "
1135 "capability is required", /* 22 */
1136 "Association request rejected because the information in the "
1137 "Power Capability element is unacceptable", /* 23 */
1138 "Association request rejected because the information in the "
1139 "Supported Channels element is unacceptable", /* 24 */
1140 "Association denied due to requesting station not supporting "
1141 "short slot operation", /* 25 */
1142 "Association denied due to requesting station not supporting "
1143 "DSSS-OFDM operation", /* 26 */
1144 "Association denied because the requested STA does not support HT "
1145 "features", /* 27 */
1146 "Reserved", /* 28 */
1147 "Association denied because the requested STA does not support "
1148 "the PCO transition time required by the AP", /* 29 */
1149 "Reserved", /* 30 */
1150 "Reserved", /* 31 */
1151 "Unspecified, QoS-related failure", /* 32 */
1152 "Association denied due to QAP having insufficient bandwidth "
1153 "to handle another QSTA", /* 33 */
1154 "Association denied due to excessive frame loss rates and/or "
1155 "poor conditions on current operating channel", /* 34 */
1156 "Association (with QBSS) denied due to requesting station not "
1157 "supporting the QoS facility", /* 35 */
1158 "Association denied due to requesting station not supporting "
1159 "Block Ack", /* 36 */
1160 "The request has been declined", /* 37 */
1161 "The request has not been successful as one or more parameters "
1162 "have invalid values", /* 38 */
1163 "The TS has not been created because the request cannot be honored. "
1164 "However, a suggested TSPEC is provided so that the initiating QSTA"
1165 "may attempt to set another TS with the suggested changes to the "
1166 "TSPEC", /* 39 */
1167 "Invalid Information Element", /* 40 */
1168 "Group Cipher is not valid", /* 41 */
1169 "Pairwise Cipher is not valid", /* 42 */
1170 "AKMP is not valid", /* 43 */
1171 "Unsupported RSN IE version", /* 44 */
1172 "Invalid RSN IE Capabilities", /* 45 */
1173 "Cipher suite is rejected per security policy", /* 46 */
1174 "The TS has not been created. However, the HC may be capable of "
1175 "creating a TS, in response to a request, after the time indicated "
1176 "in the TS Delay element", /* 47 */
1177 "Direct Link is not allowed in the BSS by policy", /* 48 */
1178 "Destination STA is not present within this QBSS.", /* 49 */
1179 "The Destination STA is not a QSTA.", /* 50 */
1180
1181 };
1182 #define NUM_STATUSES (sizeof status_text / sizeof status_text[0])
1183
1184 static const char *reason_text[] = {
1185 "Reserved", /* 0 */
1186 "Unspecified reason", /* 1 */
1187 "Previous authentication no longer valid", /* 2 */
1188 "Deauthenticated because sending station is leaving (or has left) "
1189 "IBSS or ESS", /* 3 */
1190 "Disassociated due to inactivity", /* 4 */
1191 "Disassociated because AP is unable to handle all currently "
1192 " associated stations", /* 5 */
1193 "Class 2 frame received from nonauthenticated station", /* 6 */
1194 "Class 3 frame received from nonassociated station", /* 7 */
1195 "Disassociated because sending station is leaving "
1196 "(or has left) BSS", /* 8 */
1197 "Station requesting (re)association is not authenticated with "
1198 "responding station", /* 9 */
1199 "Disassociated because the information in the Power Capability "
1200 "element is unacceptable", /* 10 */
1201 "Disassociated because the information in the SupportedChannels "
1202 "element is unacceptable", /* 11 */
1203 "Invalid Information Element", /* 12 */
1204 "Reserved", /* 13 */
1205 "Michael MIC failure", /* 14 */
1206 "4-Way Handshake timeout", /* 15 */
1207 "Group key update timeout", /* 16 */
1208 "Information element in 4-Way Handshake different from (Re)Association"
1209 "Request/Probe Response/Beacon", /* 17 */
1210 "Group Cipher is not valid", /* 18 */
1211 "AKMP is not valid", /* 20 */
1212 "Unsupported RSN IE version", /* 21 */
1213 "Invalid RSN IE Capabilities", /* 22 */
1214 "IEEE 802.1X Authentication failed", /* 23 */
1215 "Cipher suite is rejected per security policy", /* 24 */
1216 "Reserved", /* 25 */
1217 "Reserved", /* 26 */
1218 "Reserved", /* 27 */
1219 "Reserved", /* 28 */
1220 "Reserved", /* 29 */
1221 "Reserved", /* 30 */
1222 "TS deleted because QoS AP lacks sufficient bandwidth for this "
1223 "QoS STA due to a change in BSS service characteristics or "
1224 "operational mode (e.g. an HT BSS change from 40 MHz channel "
1225 "to 20 MHz channel)", /* 31 */
1226 "Disassociated for unspecified, QoS-related reason", /* 32 */
1227 "Disassociated because QoS AP lacks sufficient bandwidth for this "
1228 "QoS STA", /* 33 */
1229 "Disassociated because of excessive number of frames that need to be "
1230 "acknowledged, but are not acknowledged for AP transmissions "
1231 "and/or poor channel conditions", /* 34 */
1232 "Disassociated because STA is transmitting outside the limits "
1233 "of its TXOPs", /* 35 */
1234 "Requested from peer STA as the STA is leaving the BSS "
1235 "(or resetting)", /* 36 */
1236 "Requested from peer STA as it does not want to use the "
1237 "mechanism", /* 37 */
1238 "Requested from peer STA as the STA received frames using the "
1239 "mechanism for which a set up is required", /* 38 */
1240 "Requested from peer STA due to time out", /* 39 */
1241 "Reserved", /* 40 */
1242 "Reserved", /* 41 */
1243 "Reserved", /* 42 */
1244 "Reserved", /* 43 */
1245 "Reserved", /* 44 */
1246 "Peer STA does not support the requested cipher suite", /* 45 */
1247 "Association denied due to requesting STA not supporting HT "
1248 "features", /* 46 */
1249 };
1250 #define NUM_REASONS (sizeof reason_text / sizeof reason_text[0])
1251
1252 static int
1253 wep_print(const u_char *p)
1254 {
1255 u_int32_t iv;
1256
1257 if (!TTEST2(*p, IEEE802_11_IV_LEN + IEEE802_11_KID_LEN))
1258 return 0;
1259 iv = EXTRACT_LE_32BITS(p);
1260
1261 printf("Data IV:%3x Pad %x KeyID %x", IV_IV(iv), IV_PAD(iv),
1262 IV_KEYID(iv));
1263
1264 return 1;
1265 }
1266
1267 static int
1268 parse_elements(struct mgmt_body_t *pbody, const u_char *p, int offset,
1269 u_int length)
1270 {
1271 u_int elementlen;
1272 struct ssid_t ssid;
1273 struct challenge_t challenge;
1274 struct rates_t rates;
1275 struct ds_t ds;
1276 struct cf_t cf;
1277 struct tim_t tim;
1278
1279 /*
1280 * We haven't seen any elements yet.
1281 */
1282 pbody->challenge_present = 0;
1283 pbody->ssid_present = 0;
1284 pbody->rates_present = 0;
1285 pbody->ds_present = 0;
1286 pbody->cf_present = 0;
1287 pbody->tim_present = 0;
1288
1289 while (length != 0) {
1290 if (!TTEST2(*(p + offset), 1))
1291 return 0;
1292 if (length < 1)
1293 return 0;
1294 switch (*(p + offset)) {
1295 case E_SSID:
1296 if (!TTEST2(*(p + offset), 2))
1297 return 0;
1298 if (length < 2)
1299 return 0;
1300 memcpy(&ssid, p + offset, 2);
1301 offset += 2;
1302 length -= 2;
1303 if (ssid.length != 0) {
1304 if (ssid.length > sizeof(ssid.ssid) - 1)
1305 return 0;
1306 if (!TTEST2(*(p + offset), ssid.length))
1307 return 0;
1308 if (length < ssid.length)
1309 return 0;
1310 memcpy(&ssid.ssid, p + offset, ssid.length);
1311 offset += ssid.length;
1312 length -= ssid.length;
1313 }
1314 ssid.ssid[ssid.length] = '\0';
1315 /*
1316 * Present and not truncated.
1317 *
1318 * If we haven't already seen an SSID IE,
1319 * copy this one, otherwise ignore this one,
1320 * so we later report the first one we saw.
1321 */
1322 if (!pbody->ssid_present) {
1323 pbody->ssid = ssid;
1324 pbody->ssid_present = 1;
1325 }
1326 break;
1327 case E_CHALLENGE:
1328 if (!TTEST2(*(p + offset), 2))
1329 return 0;
1330 if (length < 2)
1331 return 0;
1332 memcpy(&challenge, p + offset, 2);
1333 offset += 2;
1334 length -= 2;
1335 if (challenge.length != 0) {
1336 if (challenge.length >
1337 sizeof(challenge.text) - 1)
1338 return 0;
1339 if (!TTEST2(*(p + offset), challenge.length))
1340 return 0;
1341 if (length < challenge.length)
1342 return 0;
1343 memcpy(&challenge.text, p + offset,
1344 challenge.length);
1345 offset += challenge.length;
1346 length -= challenge.length;
1347 }
1348 challenge.text[challenge.length] = '\0';
1349 /*
1350 * Present and not truncated.
1351 *
1352 * If we haven't already seen a challenge IE,
1353 * copy this one, otherwise ignore this one,
1354 * so we later report the first one we saw.
1355 */
1356 if (!pbody->challenge_present) {
1357 pbody->challenge = challenge;
1358 pbody->challenge_present = 1;
1359 }
1360 break;
1361 case E_RATES:
1362 if (!TTEST2(*(p + offset), 2))
1363 return 0;
1364 if (length < 2)
1365 return 0;
1366 memcpy(&rates, p + offset, 2);
1367 offset += 2;
1368 length -= 2;
1369 if (rates.length != 0) {
1370 if (rates.length > sizeof rates.rate)
1371 return 0;
1372 if (!TTEST2(*(p + offset), rates.length))
1373 return 0;
1374 if (length < rates.length)
1375 return 0;
1376 memcpy(&rates.rate, p + offset, rates.length);
1377 offset += rates.length;
1378 length -= rates.length;
1379 }
1380 /*
1381 * Present and not truncated.
1382 *
1383 * If we haven't already seen a rates IE,
1384 * copy this one if it's not zero-length,
1385 * otherwise ignore this one, so we later
1386 * report the first one we saw.
1387 *
1388 * We ignore zero-length rates IEs as some
1389 * devices seem to put a zero-length rates
1390 * IE, followed by an SSID IE, followed by
1391 * a non-zero-length rates IE into frames,
1392 * even though IEEE Std 802.11-2007 doesn't
1393 * seem to indicate that a zero-length rates
1394 * IE is valid.
1395 */
1396 if (!pbody->rates_present && rates.length != 0) {
1397 pbody->rates = rates;
1398 pbody->rates_present = 1;
1399 }
1400 break;
1401 case E_DS:
1402 if (!TTEST2(*(p + offset), 3))
1403 return 0;
1404 if (length < 3)
1405 return 0;
1406 memcpy(&ds, p + offset, 3);
1407 offset += 3;
1408 length -= 3;
1409 /*
1410 * Present and not truncated.
1411 *
1412 * If we haven't already seen a DS IE,
1413 * copy this one, otherwise ignore this one,
1414 * so we later report the first one we saw.
1415 */
1416 if (!pbody->ds_present) {
1417 pbody->ds = ds;
1418 pbody->ds_present = 1;
1419 }
1420 break;
1421 case E_CF:
1422 if (!TTEST2(*(p + offset), 8))
1423 return 0;
1424 if (length < 8)
1425 return 0;
1426 memcpy(&cf, p + offset, 8);
1427 offset += 8;
1428 length -= 8;
1429 /*
1430 * Present and not truncated.
1431 *
1432 * If we haven't already seen a CF IE,
1433 * copy this one, otherwise ignore this one,
1434 * so we later report the first one we saw.
1435 */
1436 if (!pbody->cf_present) {
1437 pbody->cf = cf;
1438 pbody->cf_present = 1;
1439 }
1440 break;
1441 case E_TIM:
1442 if (!TTEST2(*(p + offset), 2))
1443 return 0;
1444 if (length < 2)
1445 return 0;
1446 memcpy(&tim, p + offset, 2);
1447 offset += 2;
1448 length -= 2;
1449 if (!TTEST2(*(p + offset), 3))
1450 return 0;
1451 if (length < 3)
1452 return 0;
1453 memcpy(&tim.count, p + offset, 3);
1454 offset += 3;
1455 length -= 3;
1456
1457 if (tim.length <= 3)
1458 break;
1459 if (tim.length - 3 > (int)sizeof tim.bitmap)
1460 return 0;
1461 if (!TTEST2(*(p + offset), tim.length - 3))
1462 return 0;
1463 if (length < (u_int)(tim.length - 3))
1464 return 0;
1465 memcpy(tim.bitmap, p + (tim.length - 3),
1466 (tim.length - 3));
1467 offset += tim.length - 3;
1468 length -= tim.length - 3;
1469 /*
1470 * Present and not truncated.
1471 *
1472 * If we haven't already seen a TIM IE,
1473 * copy this one, otherwise ignore this one,
1474 * so we later report the first one we saw.
1475 */
1476 if (!pbody->tim_present) {
1477 pbody->tim = tim;
1478 pbody->tim_present = 1;
1479 }
1480 break;
1481 default:
1482 #if 0
1483 printf("(1) unhandled element_id (%d) ",
1484 *(p + offset));
1485 #endif
1486 if (!TTEST2(*(p + offset), 2))
1487 return 0;
1488 if (length < 2)
1489 return 0;
1490 elementlen = *(p + offset + 1);
1491 if (!TTEST2(*(p + offset + 2), elementlen))
1492 return 0;
1493 if (length < elementlen + 2)
1494 return 0;
1495 offset += elementlen + 2;
1496 length -= elementlen + 2;
1497 break;
1498 }
1499 }
1500
1501 /* No problems found. */
1502 return 1;
1503 }
1504
1505 /*********************************************************************************
1506 * Print Handle functions for the management frame types
1507 *********************************************************************************/
1508
1509 static int
1510 handle_beacon(const u_char *p, u_int length)
1511 {
1512 struct mgmt_body_t pbody;
1513 int offset = 0;
1514 int ret;
1515
1516 memset(&pbody, 0, sizeof(pbody));
1517
1518 if (!TTEST2(*p, IEEE802_11_TSTAMP_LEN + IEEE802_11_BCNINT_LEN +
1519 IEEE802_11_CAPINFO_LEN))
1520 return 0;
1521 if (length < IEEE802_11_TSTAMP_LEN + IEEE802_11_BCNINT_LEN +
1522 IEEE802_11_CAPINFO_LEN)
1523 return 0;
1524 memcpy(&pbody.timestamp, p, IEEE802_11_TSTAMP_LEN);
1525 offset += IEEE802_11_TSTAMP_LEN;
1526 length -= IEEE802_11_TSTAMP_LEN;
1527 pbody.beacon_interval = EXTRACT_LE_16BITS(p+offset);
1528 offset += IEEE802_11_BCNINT_LEN;
1529 length -= IEEE802_11_BCNINT_LEN;
1530 pbody.capability_info = EXTRACT_LE_16BITS(p+offset);
1531 offset += IEEE802_11_CAPINFO_LEN;
1532 length -= IEEE802_11_CAPINFO_LEN;
1533
1534 ret = parse_elements(&pbody, p, offset, length);
1535
1536 PRINT_SSID(pbody);
1537 PRINT_RATES(pbody);
1538 printf(" %s",
1539 CAPABILITY_ESS(pbody.capability_info) ? "ESS" : "IBSS");
1540 PRINT_DS_CHANNEL(pbody);
1541
1542 return ret;
1543 }
1544
1545 static int
1546 handle_assoc_request(const u_char *p, u_int length)
1547 {
1548 struct mgmt_body_t pbody;
1549 int offset = 0;
1550 int ret;
1551
1552 memset(&pbody, 0, sizeof(pbody));
1553
1554 if (!TTEST2(*p, IEEE802_11_CAPINFO_LEN + IEEE802_11_LISTENINT_LEN))
1555 return 0;
1556 if (length < IEEE802_11_CAPINFO_LEN + IEEE802_11_LISTENINT_LEN)
1557 return 0;
1558 pbody.capability_info = EXTRACT_LE_16BITS(p);
1559 offset += IEEE802_11_CAPINFO_LEN;
1560 length -= IEEE802_11_CAPINFO_LEN;
1561 pbody.listen_interval = EXTRACT_LE_16BITS(p+offset);
1562 offset += IEEE802_11_LISTENINT_LEN;
1563 length -= IEEE802_11_LISTENINT_LEN;
1564
1565 ret = parse_elements(&pbody, p, offset, length);
1566
1567 PRINT_SSID(pbody);
1568 PRINT_RATES(pbody);
1569 return ret;
1570 }
1571
1572 static int
1573 handle_assoc_response(const u_char *p, u_int length)
1574 {
1575 struct mgmt_body_t pbody;
1576 int offset = 0;
1577 int ret;
1578
1579 memset(&pbody, 0, sizeof(pbody));
1580
1581 if (!TTEST2(*p, IEEE802_11_CAPINFO_LEN + IEEE802_11_STATUS_LEN +
1582 IEEE802_11_AID_LEN))
1583 return 0;
1584 if (length < IEEE802_11_CAPINFO_LEN + IEEE802_11_STATUS_LEN +
1585 IEEE802_11_AID_LEN)
1586 return 0;
1587 pbody.capability_info = EXTRACT_LE_16BITS(p);
1588 offset += IEEE802_11_CAPINFO_LEN;
1589 length -= IEEE802_11_CAPINFO_LEN;
1590 pbody.status_code = EXTRACT_LE_16BITS(p+offset);
1591 offset += IEEE802_11_STATUS_LEN;
1592 length -= IEEE802_11_STATUS_LEN;
1593 pbody.aid = EXTRACT_LE_16BITS(p+offset);
1594 offset += IEEE802_11_AID_LEN;
1595 length -= IEEE802_11_AID_LEN;
1596
1597 ret = parse_elements(&pbody, p, offset, length);
1598
1599 printf(" AID(%x) :%s: %s", ((u_int16_t)(pbody.aid << 2 )) >> 2 ,
1600 CAPABILITY_PRIVACY(pbody.capability_info) ? " PRIVACY " : "",
1601 (pbody.status_code < NUM_STATUSES
1602 ? status_text[pbody.status_code]
1603 : "n/a"));
1604
1605 return ret;
1606 }
1607
1608 static int
1609 handle_reassoc_request(const u_char *p, u_int length)
1610 {
1611 struct mgmt_body_t pbody;
1612 int offset = 0;
1613 int ret;
1614
1615 memset(&pbody, 0, sizeof(pbody));
1616
1617 if (!TTEST2(*p, IEEE802_11_CAPINFO_LEN + IEEE802_11_LISTENINT_LEN +
1618 IEEE802_11_AP_LEN))
1619 return 0;
1620 if (length < IEEE802_11_CAPINFO_LEN + IEEE802_11_LISTENINT_LEN +
1621 IEEE802_11_AP_LEN)
1622 return 0;
1623 pbody.capability_info = EXTRACT_LE_16BITS(p);
1624 offset += IEEE802_11_CAPINFO_LEN;
1625 length -= IEEE802_11_CAPINFO_LEN;
1626 pbody.listen_interval = EXTRACT_LE_16BITS(p+offset);
1627 offset += IEEE802_11_LISTENINT_LEN;
1628 length -= IEEE802_11_LISTENINT_LEN;
1629 memcpy(&pbody.ap, p+offset, IEEE802_11_AP_LEN);
1630 offset += IEEE802_11_AP_LEN;
1631 length -= IEEE802_11_AP_LEN;
1632
1633 ret = parse_elements(&pbody, p, offset, length);
1634
1635 PRINT_SSID(pbody);
1636 printf(" AP : %s", etheraddr_string( pbody.ap ));
1637
1638 return ret;
1639 }
1640
1641 static int
1642 handle_reassoc_response(const u_char *p, u_int length)
1643 {
1644 /* Same as a Association Reponse */
1645 return handle_assoc_response(p, length);
1646 }
1647
1648 static int
1649 handle_probe_request(const u_char *p, u_int length)
1650 {
1651 struct mgmt_body_t pbody;
1652 int offset = 0;
1653 int ret;
1654
1655 memset(&pbody, 0, sizeof(pbody));
1656
1657 ret = parse_elements(&pbody, p, offset, length);
1658
1659 PRINT_SSID(pbody);
1660 PRINT_RATES(pbody);
1661
1662 return ret;
1663 }
1664
1665 static int
1666 handle_probe_response(const u_char *p, u_int length)
1667 {
1668 struct mgmt_body_t pbody;
1669 int offset = 0;
1670 int ret;
1671
1672 memset(&pbody, 0, sizeof(pbody));
1673
1674 if (!TTEST2(*p, IEEE802_11_TSTAMP_LEN + IEEE802_11_BCNINT_LEN +
1675 IEEE802_11_CAPINFO_LEN))
1676 return 0;
1677 if (length < IEEE802_11_TSTAMP_LEN + IEEE802_11_BCNINT_LEN +
1678 IEEE802_11_CAPINFO_LEN)
1679 return 0;
1680 memcpy(&pbody.timestamp, p, IEEE802_11_TSTAMP_LEN);
1681 offset += IEEE802_11_TSTAMP_LEN;
1682 length -= IEEE802_11_TSTAMP_LEN;
1683 pbody.beacon_interval = EXTRACT_LE_16BITS(p+offset);
1684 offset += IEEE802_11_BCNINT_LEN;
1685 length -= IEEE802_11_BCNINT_LEN;
1686 pbody.capability_info = EXTRACT_LE_16BITS(p+offset);
1687 offset += IEEE802_11_CAPINFO_LEN;
1688 length -= IEEE802_11_CAPINFO_LEN;
1689
1690 ret = parse_elements(&pbody, p, offset, length);
1691
1692 PRINT_SSID(pbody);
1693 PRINT_RATES(pbody);
1694 PRINT_DS_CHANNEL(pbody);
1695
1696 return ret;
1697 }
1698
1699 static int
1700 handle_atim(void)
1701 {
1702 /* the frame body for ATIM is null. */
1703 return 1;
1704 }
1705
1706 static int
1707 handle_disassoc(const u_char *p, u_int length)
1708 {
1709 struct mgmt_body_t pbody;
1710
1711 memset(&pbody, 0, sizeof(pbody));
1712
1713 if (!TTEST2(*p, IEEE802_11_REASON_LEN))
1714 return 0;
1715 if (length < IEEE802_11_REASON_LEN)
1716 return 0;
1717 pbody.reason_code = EXTRACT_LE_16BITS(p);
1718
1719 printf(": %s",
1720 (pbody.reason_code < NUM_REASONS)
1721 ? reason_text[pbody.reason_code]
1722 : "Reserved" );
1723
1724 return 1;
1725 }
1726
1727 static int
1728 handle_auth(const u_char *p, u_int length)
1729 {
1730 struct mgmt_body_t pbody;
1731 int offset = 0;
1732 int ret;
1733
1734 memset(&pbody, 0, sizeof(pbody));
1735
1736 if (!TTEST2(*p, 6))
1737 return 0;
1738 if (length < 6)
1739 return 0;
1740 pbody.auth_alg = EXTRACT_LE_16BITS(p);
1741 offset += 2;
1742 length -= 2;
1743 pbody.auth_trans_seq_num = EXTRACT_LE_16BITS(p + offset);
1744 offset += 2;
1745 length -= 2;
1746 pbody.status_code = EXTRACT_LE_16BITS(p + offset);
1747 offset += 2;
1748 length -= 2;
1749
1750 ret = parse_elements(&pbody, p, offset, length);
1751
1752 if ((pbody.auth_alg == 1) &&
1753 ((pbody.auth_trans_seq_num == 2) ||
1754 (pbody.auth_trans_seq_num == 3))) {
1755 printf(" (%s)-%x [Challenge Text] %s",
1756 (pbody.auth_alg < NUM_AUTH_ALGS)
1757 ? auth_alg_text[pbody.auth_alg]
1758 : "Reserved",
1759 pbody.auth_trans_seq_num,
1760 ((pbody.auth_trans_seq_num % 2)
1761 ? ((pbody.status_code < NUM_STATUSES)
1762 ? status_text[pbody.status_code]
1763 : "n/a") : ""));
1764 return ret;
1765 }
1766 printf(" (%s)-%x: %s",
1767 (pbody.auth_alg < NUM_AUTH_ALGS)
1768 ? auth_alg_text[pbody.auth_alg]
1769 : "Reserved",
1770 pbody.auth_trans_seq_num,
1771 (pbody.auth_trans_seq_num % 2)
1772 ? ((pbody.status_code < NUM_STATUSES)
1773 ? status_text[pbody.status_code]
1774 : "n/a")
1775 : "");
1776
1777 return ret;
1778 }
1779
1780 static int
1781 handle_deauth(const struct mgmt_header_t *pmh, const u_char *p, u_int length)
1782 {
1783 struct mgmt_body_t pbody;
1784 int offset = 0;
1785 const char *reason = NULL;
1786
1787 memset(&pbody, 0, sizeof(pbody));
1788
1789 if (!TTEST2(*p, IEEE802_11_REASON_LEN))
1790 return 0;
1791 if (length < IEEE802_11_REASON_LEN)
1792 return 0;
1793 pbody.reason_code = EXTRACT_LE_16BITS(p);
1794 offset += IEEE802_11_REASON_LEN;
1795 length -= IEEE802_11_REASON_LEN;
1796
1797 reason = (pbody.reason_code < NUM_REASONS)
1798 ? reason_text[pbody.reason_code]
1799 : "Reserved";
1800
1801 if (eflag) {
1802 printf(": %s", reason);
1803 } else {
1804 printf(" (%s): %s", etheraddr_string(pmh->sa), reason);
1805 }
1806 return 1;
1807 }
1808
1809 #define PRINT_HT_ACTION(v) (\
1810 (v) == 0 ? printf("TxChWidth") : \
1811 (v) == 1 ? printf("MIMOPwrSave") : \
1812 printf("Act#%d", (v)) \
1813 )
1814 #define PRINT_BA_ACTION(v) (\
1815 (v) == 0 ? printf("ADDBA Request") : \
1816 (v) == 1 ? printf("ADDBA Response") : \
1817 (v) == 2 ? printf("DELBA") : \
1818 printf("Act#%d", (v)) \
1819 )
1820 #define PRINT_MESHLINK_ACTION(v) (\
1821 (v) == 0 ? printf("Request") : \
1822 (v) == 1 ? printf("Report") : \
1823 printf("Act#%d", (v)) \
1824 )
1825 #define PRINT_MESHPEERING_ACTION(v) (\
1826 (v) == 0 ? printf("Open") : \
1827 (v) == 1 ? printf("Confirm") : \
1828 (v) == 2 ? printf("Close") : \
1829 printf("Act#%d", (v)) \
1830 )
1831 #define PRINT_MESHPATH_ACTION(v) (\
1832 (v) == 0 ? printf("Request") : \
1833 (v) == 1 ? printf("Report") : \
1834 (v) == 2 ? printf("Error") : \
1835 (v) == 3 ? printf("RootAnnouncement") : \
1836 printf("Act#%d", (v)) \
1837 )
1838
1839 #define PRINT_MESH_ACTION(v) (\
1840 (v) == 0 ? printf("MeshLink") : \
1841 (v) == 1 ? printf("HWMP") : \
1842 (v) == 2 ? printf("Gate Announcement") : \
1843 (v) == 3 ? printf("Congestion Control") : \
1844 (v) == 4 ? printf("MCCA Setup Request") : \
1845 (v) == 5 ? printf("MCCA Setup Reply") : \
1846 (v) == 6 ? printf("MCCA Advertisement Request") : \
1847 (v) == 7 ? printf("MCCA Advertisement") : \
1848 (v) == 8 ? printf("MCCA Teardown") : \
1849 (v) == 9 ? printf("TBTT Adjustment Request") : \
1850 (v) == 10 ? printf("TBTT Adjustment Response") : \
1851 printf("Act#%d", (v)) \
1852 )
1853 #define PRINT_MULTIHOP_ACTION(v) (\
1854 (v) == 0 ? printf("Proxy Update") : \
1855 (v) == 1 ? printf("Proxy Update Confirmation") : \
1856 printf("Act#%d", (v)) \
1857 )
1858 #define PRINT_SELFPROT_ACTION(v) (\
1859 (v) == 1 ? printf("Peering Open") : \
1860 (v) == 2 ? printf("Peering Confirm") : \
1861 (v) == 3 ? printf("Peering Close") : \
1862 (v) == 4 ? printf("Group Key Inform") : \
1863 (v) == 5 ? printf("Group Key Acknowledge") : \
1864 printf("Act#%d", (v)) \
1865 )
1866
1867 static int
1868 handle_action(const struct mgmt_header_t *pmh, const u_char *p, u_int length)
1869 {
1870 if (!TTEST2(*p, 2))
1871 return 0;
1872 if (length < 2)
1873 return 0;
1874 if (eflag) {
1875 printf(": ");
1876 } else {
1877 printf(" (%s): ", etheraddr_string(pmh->sa));
1878 }
1879 switch (p[0]) {
1880 case 0: printf("Spectrum Management Act#%d", p[1]); break;
1881 case 1: printf("QoS Act#%d", p[1]); break;
1882 case 2: printf("DLS Act#%d", p[1]); break;
1883 case 3: printf("BA "); PRINT_BA_ACTION(p[1]); break;
1884 case 7: printf("HT "); PRINT_HT_ACTION(p[1]); break;
1885 case 13: printf("MeshAction "); PRINT_MESH_ACTION(p[1]); break;
1886 case 14:
1887 printf("MultiohopAction ");
1888 PRINT_MULTIHOP_ACTION(p[1]); break;
1889 case 15:
1890 printf("SelfprotectAction ");
1891 PRINT_SELFPROT_ACTION(p[1]); break;
1892 case 127: printf("Vendor Act#%d", p[1]); break;
1893 default:
1894 printf("Reserved(%d) Act#%d", p[0], p[1]);
1895 break;
1896 }
1897 return 1;
1898 }
1899
1900
1901 /*********************************************************************************
1902 * Print Body funcs
1903 *********************************************************************************/
1904
1905
1906 static int
1907 mgmt_body_print(u_int16_t fc, const struct mgmt_header_t *pmh,
1908 const u_char *p, u_int length)
1909 {
1910 switch (FC_SUBTYPE(fc)) {
1911 case ST_ASSOC_REQUEST:
1912 printf("Assoc Request");
1913 return handle_assoc_request(p, length);
1914 case ST_ASSOC_RESPONSE:
1915 printf("Assoc Response");
1916 return handle_assoc_response(p, length);
1917 case ST_REASSOC_REQUEST:
1918 printf("ReAssoc Request");
1919 return handle_reassoc_request(p, length);
1920 case ST_REASSOC_RESPONSE:
1921 printf("ReAssoc Response");
1922 return handle_reassoc_response(p, length);
1923 case ST_PROBE_REQUEST:
1924 printf("Probe Request");
1925 return handle_probe_request(p, length);
1926 case ST_PROBE_RESPONSE:
1927 printf("Probe Response");
1928 return handle_probe_response(p, length);
1929 case ST_BEACON:
1930 printf("Beacon");
1931 return handle_beacon(p, length);
1932 case ST_ATIM:
1933 printf("ATIM");
1934 return handle_atim();
1935 case ST_DISASSOC:
1936 printf("Disassociation");
1937 return handle_disassoc(p, length);
1938 case ST_AUTH:
1939 printf("Authentication");
1940 if (!TTEST2(*p, 3))
1941 return 0;
1942 if ((p[0] == 0 ) && (p[1] == 0) && (p[2] == 0)) {
1943 printf("Authentication (Shared-Key)-3 ");
1944 return wep_print(p);
1945 }
1946 return handle_auth(p, length);
1947 case ST_DEAUTH:
1948 printf("DeAuthentication");
1949 return handle_deauth(pmh, p, length);
1950 break;
1951 case ST_ACTION:
1952 printf("Action");
1953 return handle_action(pmh, p, length);
1954 break;
1955 default:
1956 printf("Unhandled Management subtype(%x)",
1957 FC_SUBTYPE(fc));
1958 return 1;
1959 }
1960 }
1961
1962
1963 /*********************************************************************************
1964 * Handles printing all the control frame types
1965 *********************************************************************************/
1966
1967 static int
1968 ctrl_body_print(u_int16_t fc, const u_char *p)
1969 {
1970 switch (FC_SUBTYPE(fc)) {
1971 case CTRL_CONTROL_WRAPPER:
1972 printf("Control Wrapper");
1973 /* XXX - requires special handling */
1974 break;
1975 case CTRL_BAR:
1976 printf("BAR");
1977 if (!TTEST2(*p, CTRL_BAR_HDRLEN))
1978 return 0;
1979 if (!eflag)
1980 printf(" RA:%s TA:%s CTL(%x) SEQ(%u) ",
1981 etheraddr_string(((const struct ctrl_bar_t *)p)->ra),
1982 etheraddr_string(((const struct ctrl_bar_t *)p)->ta),
1983 EXTRACT_LE_16BITS(&(((const struct ctrl_bar_t *)p)->ctl)),
1984 EXTRACT_LE_16BITS(&(((const struct ctrl_bar_t *)p)->seq)));
1985 break;
1986 case CTRL_BA:
1987 printf("BA");
1988 if (!TTEST2(*p, CTRL_BA_HDRLEN))
1989 return 0;
1990 if (!eflag)
1991 printf(" RA:%s ",
1992 etheraddr_string(((const struct ctrl_ba_t *)p)->ra));
1993 break;
1994 case CTRL_PS_POLL:
1995 printf("Power Save-Poll");
1996 if (!TTEST2(*p, CTRL_PS_POLL_HDRLEN))
1997 return 0;
1998 printf(" AID(%x)",
1999 EXTRACT_LE_16BITS(&(((const struct ctrl_ps_poll_t *)p)->aid)));
2000 break;
2001 case CTRL_RTS:
2002 printf("Request-To-Send");
2003 if (!TTEST2(*p, CTRL_RTS_HDRLEN))
2004 return 0;
2005 if (!eflag)
2006 printf(" TA:%s ",
2007 etheraddr_string(((const struct ctrl_rts_t *)p)->ta));
2008 break;
2009 case CTRL_CTS:
2010 printf("Clear-To-Send");
2011 if (!TTEST2(*p, CTRL_CTS_HDRLEN))
2012 return 0;
2013 if (!eflag)
2014 printf(" RA:%s ",
2015 etheraddr_string(((const struct ctrl_cts_t *)p)->ra));
2016 break;
2017 case CTRL_ACK:
2018 printf("Acknowledgment");
2019 if (!TTEST2(*p, CTRL_ACK_HDRLEN))
2020 return 0;
2021 if (!eflag)
2022 printf(" RA:%s ",
2023 etheraddr_string(((const struct ctrl_ack_t *)p)->ra));
2024 break;
2025 case CTRL_CF_END:
2026 printf("CF-End");
2027 if (!TTEST2(*p, CTRL_END_HDRLEN))
2028 return 0;
2029 if (!eflag)
2030 printf(" RA:%s ",
2031 etheraddr_string(((const struct ctrl_end_t *)p)->ra));
2032 break;
2033 case CTRL_END_ACK:
2034 printf("CF-End+CF-Ack");
2035 if (!TTEST2(*p, CTRL_END_ACK_HDRLEN))
2036 return 0;
2037 if (!eflag)
2038 printf(" RA:%s ",
2039 etheraddr_string(((const struct ctrl_end_ack_t *)p)->ra));
2040 break;
2041 default:
2042 printf("Unknown Ctrl Subtype");
2043 }
2044 return 1;
2045 }
2046
2047 /*
2048 * Print Header funcs
2049 */
2050
2051 /*
2052 * Data Frame - Address field contents
2053 *
2054 * To Ds | From DS | Addr 1 | Addr 2 | Addr 3 | Addr 4
2055 * 0 | 0 | DA | SA | BSSID | n/a
2056 * 0 | 1 | DA | BSSID | SA | n/a
2057 * 1 | 0 | BSSID | SA | DA | n/a
2058 * 1 | 1 | RA | TA | DA | SA
2059 */
2060
2061 static void
2062 data_header_print(u_int16_t fc, const u_char *p, const u_int8_t **srcp,
2063 const u_int8_t **dstp)
2064 {
2065 u_int subtype = FC_SUBTYPE(fc);
2066
2067 if (DATA_FRAME_IS_CF_ACK(subtype) || DATA_FRAME_IS_CF_POLL(subtype) ||
2068 DATA_FRAME_IS_QOS(subtype)) {
2069 printf("CF ");
2070 if (DATA_FRAME_IS_CF_ACK(subtype)) {
2071 if (DATA_FRAME_IS_CF_POLL(subtype))
2072 printf("Ack/Poll");
2073 else
2074 printf("Ack");
2075 } else {
2076 if (DATA_FRAME_IS_CF_POLL(subtype))
2077 printf("Poll");
2078 }
2079 if (DATA_FRAME_IS_QOS(subtype))
2080 printf("+QoS");
2081 printf(" ");
2082 }
2083
2084 #define ADDR1 (p + 4)
2085 #define ADDR2 (p + 10)
2086 #define ADDR3 (p + 16)
2087 #define ADDR4 (p + 24)
2088
2089 if (!FC_TO_DS(fc) && !FC_FROM_DS(fc)) {
2090 if (srcp != NULL)
2091 *srcp = ADDR2;
2092 if (dstp != NULL)
2093 *dstp = ADDR1;
2094 if (!eflag)
2095 return;
2096 printf("DA:%s SA:%s BSSID:%s ",
2097 etheraddr_string(ADDR1), etheraddr_string(ADDR2),
2098 etheraddr_string(ADDR3));
2099 } else if (!FC_TO_DS(fc) && FC_FROM_DS(fc)) {
2100 if (srcp != NULL)
2101 *srcp = ADDR3;
2102 if (dstp != NULL)
2103 *dstp = ADDR1;
2104 if (!eflag)
2105 return;
2106 printf("DA:%s BSSID:%s SA:%s ",
2107 etheraddr_string(ADDR1), etheraddr_string(ADDR2),
2108 etheraddr_string(ADDR3));
2109 } else if (FC_TO_DS(fc) && !FC_FROM_DS(fc)) {
2110 if (srcp != NULL)
2111 *srcp = ADDR2;
2112 if (dstp != NULL)
2113 *dstp = ADDR3;
2114 if (!eflag)
2115 return;
2116 printf("BSSID:%s SA:%s DA:%s ",
2117 etheraddr_string(ADDR1), etheraddr_string(ADDR2),
2118 etheraddr_string(ADDR3));
2119 } else if (FC_TO_DS(fc) && FC_FROM_DS(fc)) {
2120 if (srcp != NULL)
2121 *srcp = ADDR4;
2122 if (dstp != NULL)
2123 *dstp = ADDR3;
2124 if (!eflag)
2125 return;
2126 printf("RA:%s TA:%s DA:%s SA:%s ",
2127 etheraddr_string(ADDR1), etheraddr_string(ADDR2),
2128 etheraddr_string(ADDR3), etheraddr_string(ADDR4));
2129 }
2130
2131 #undef ADDR1
2132 #undef ADDR2
2133 #undef ADDR3
2134 #undef ADDR4
2135 }
2136
2137 static void
2138 mgmt_header_print(const u_char *p, const u_int8_t **srcp,
2139 const u_int8_t **dstp)
2140 {
2141 const struct mgmt_header_t *hp = (const struct mgmt_header_t *) p;
2142
2143 if (srcp != NULL)
2144 *srcp = hp->sa;
2145 if (dstp != NULL)
2146 *dstp = hp->da;
2147 if (!eflag)
2148 return;
2149
2150 printf("BSSID:%s DA:%s SA:%s ",
2151 etheraddr_string((hp)->bssid), etheraddr_string((hp)->da),
2152 etheraddr_string((hp)->sa));
2153 }
2154
2155 static void
2156 ctrl_header_print(u_int16_t fc, const u_char *p, const u_int8_t **srcp,
2157 const u_int8_t **dstp)
2158 {
2159 if (srcp != NULL)
2160 *srcp = NULL;
2161 if (dstp != NULL)
2162 *dstp = NULL;
2163 if (!eflag)
2164 return;
2165
2166 switch (FC_SUBTYPE(fc)) {
2167 case CTRL_BAR:
2168 printf(" RA:%s TA:%s CTL(%x) SEQ(%u) ",
2169 etheraddr_string(((const struct ctrl_bar_t *)p)->ra),
2170 etheraddr_string(((const struct ctrl_bar_t *)p)->ta),
2171 EXTRACT_LE_16BITS(&(((const struct ctrl_bar_t *)p)->ctl)),
2172 EXTRACT_LE_16BITS(&(((const struct ctrl_bar_t *)p)->seq)));
2173 break;
2174 case CTRL_BA:
2175 printf("RA:%s ",
2176 etheraddr_string(((const struct ctrl_ba_t *)p)->ra));
2177 break;
2178 case CTRL_PS_POLL:
2179 printf("BSSID:%s TA:%s ",
2180 etheraddr_string(((const struct ctrl_ps_poll_t *)p)->bssid),
2181 etheraddr_string(((const struct ctrl_ps_poll_t *)p)->ta));
2182 break;
2183 case CTRL_RTS:
2184 printf("RA:%s TA:%s ",
2185 etheraddr_string(((const struct ctrl_rts_t *)p)->ra),
2186 etheraddr_string(((const struct ctrl_rts_t *)p)->ta));
2187 break;
2188 case CTRL_CTS:
2189 printf("RA:%s ",
2190 etheraddr_string(((const struct ctrl_cts_t *)p)->ra));
2191 break;
2192 case CTRL_ACK:
2193 printf("RA:%s ",
2194 etheraddr_string(((const struct ctrl_ack_t *)p)->ra));
2195 break;
2196 case CTRL_CF_END:
2197 printf("RA:%s BSSID:%s ",
2198 etheraddr_string(((const struct ctrl_end_t *)p)->ra),
2199 etheraddr_string(((const struct ctrl_end_t *)p)->bssid));
2200 break;
2201 case CTRL_END_ACK:
2202 printf("RA:%s BSSID:%s ",
2203 etheraddr_string(((const struct ctrl_end_ack_t *)p)->ra),
2204 etheraddr_string(((const struct ctrl_end_ack_t *)p)->bssid));
2205 break;
2206 default:
2207 printf("(H) Unknown Ctrl Subtype");
2208 break;
2209 }
2210 }
2211
2212 static int
2213 extract_header_length(u_int16_t fc)
2214 {
2215 int len;
2216
2217 switch (FC_TYPE(fc)) {
2218 case T_MGMT:
2219 return MGMT_HDRLEN;
2220 case T_CTRL:
2221 switch (FC_SUBTYPE(fc)) {
2222 case CTRL_BAR:
2223 return CTRL_BAR_HDRLEN;
2224 case CTRL_PS_POLL:
2225 return CTRL_PS_POLL_HDRLEN;
2226 case CTRL_RTS:
2227 return CTRL_RTS_HDRLEN;
2228 case CTRL_CTS:
2229 return CTRL_CTS_HDRLEN;
2230 case CTRL_ACK:
2231 return CTRL_ACK_HDRLEN;
2232 case CTRL_CF_END:
2233 return CTRL_END_HDRLEN;
2234 case CTRL_END_ACK:
2235 return CTRL_END_ACK_HDRLEN;
2236 default:
2237 return 0;
2238 }
2239 case T_DATA:
2240 len = (FC_TO_DS(fc) && FC_FROM_DS(fc)) ? 30 : 24;
2241 if (DATA_FRAME_IS_QOS(FC_SUBTYPE(fc)))
2242 len += 2;
2243 return len;
2244 default:
2245 printf("unknown IEEE802.11 frame type (%d)", FC_TYPE(fc));
2246 return 0;
2247 }
2248 }
2249
2250 static int
2251 extract_mesh_header_length(const u_char *p)
2252 {
2253 return (p[0] &~ 3) ? 0 : 6*(1 + (p[0] & 3));
2254 }
2255
2256 /*
2257 * Print the 802.11 MAC header if eflag is set, and set "*srcp" and "*dstp"
2258 * to point to the source and destination MAC addresses in any case if
2259 * "srcp" and "dstp" aren't null.
2260 */
2261 static void
2262 ieee_802_11_hdr_print(u_int16_t fc, const u_char *p, u_int hdrlen,
2263 u_int meshdrlen, const u_int8_t **srcp, const u_int8_t **dstp)
2264 {
2265 if (vflag) {
2266 if (FC_MORE_DATA(fc))
2267 printf("More Data ");
2268 if (FC_MORE_FLAG(fc))
2269 printf("More Fragments ");
2270 if (FC_POWER_MGMT(fc))
2271 printf("Pwr Mgmt ");
2272 if (FC_RETRY(fc))
2273 printf("Retry ");
2274 if (FC_ORDER(fc))
2275 printf("Strictly Ordered ");
2276 if (FC_WEP(fc))
2277 printf("WEP Encrypted ");
2278 if (FC_TYPE(fc) != T_CTRL || FC_SUBTYPE(fc) != CTRL_PS_POLL)
2279 printf("%dus ",
2280 EXTRACT_LE_16BITS(
2281 &((const struct mgmt_header_t *)p)->duration));
2282 }
2283 if (meshdrlen != 0) {
2284 const struct meshcntl_t *mc =
2285 (const struct meshcntl_t *)&p[hdrlen - meshdrlen];
2286 int ae = mc->flags & 3;
2287
2288 printf("MeshData (AE %d TTL %u seq %u", ae, mc->ttl,
2289 EXTRACT_LE_32BITS(mc->seq));
2290 if (ae > 0)
2291 printf(" A4:%s", etheraddr_string(mc->addr4));
2292 if (ae > 1)
2293 printf(" A5:%s", etheraddr_string(mc->addr5));
2294 if (ae > 2)
2295 printf(" A6:%s", etheraddr_string(mc->addr6));
2296 printf(") ");
2297 }
2298
2299 switch (FC_TYPE(fc)) {
2300 case T_MGMT:
2301 mgmt_header_print(p, srcp, dstp);
2302 break;
2303 case T_CTRL:
2304 ctrl_header_print(fc, p, srcp, dstp);
2305 break;
2306 case T_DATA:
2307 data_header_print(fc, p, srcp, dstp);
2308 break;
2309 default:
2310 printf("(header) unknown IEEE802.11 frame type (%d)",
2311 FC_TYPE(fc));
2312 *srcp = NULL;
2313 *dstp = NULL;
2314 break;
2315 }
2316 }
2317
2318 #ifndef roundup2
2319 #define roundup2(x, y) (((x)+((y)-1))&(~((y)-1))) /* if y is powers of two */
2320 #endif
2321
2322 static u_int
2323 ieee802_11_print(const u_char *p, u_int length, u_int orig_caplen, int pad,
2324 u_int fcslen)
2325 {
2326 u_int16_t fc;
2327 u_int caplen, hdrlen, meshdrlen;
2328 const u_int8_t *src, *dst;
2329 u_short extracted_ethertype;
2330
2331 caplen = orig_caplen;
2332 /* Remove FCS, if present */
2333 if (length < fcslen) {
2334 printf("%s", tstr);
2335 return caplen;
2336 }
2337 length -= fcslen;
2338 if (caplen > length) {
2339 /* Amount of FCS in actual packet data, if any */
2340 fcslen = caplen - length;
2341 caplen -= fcslen;
2342 snapend -= fcslen;
2343 }
2344
2345 if (caplen < IEEE802_11_FC_LEN) {
2346 printf("%s", tstr);
2347 return orig_caplen;
2348 }
2349
2350 fc = EXTRACT_LE_16BITS(p);
2351 hdrlen = extract_header_length(fc);
2352 if (pad)
2353 hdrlen = roundup2(hdrlen, 4);
2354 if (Hflag && FC_TYPE(fc) == T_DATA &&
2355 DATA_FRAME_IS_QOS(FC_SUBTYPE(fc))) {
2356 meshdrlen = extract_mesh_header_length(p+hdrlen);
2357 hdrlen += meshdrlen;
2358 } else
2359 meshdrlen = 0;
2360
2361
2362 if (caplen < hdrlen) {
2363 printf("%s", tstr);
2364 return hdrlen;
2365 }
2366
2367 ieee_802_11_hdr_print(fc, p, hdrlen, meshdrlen, &src, &dst);
2368
2369 /*
2370 * Go past the 802.11 header.
2371 */
2372 length -= hdrlen;
2373 caplen -= hdrlen;
2374 p += hdrlen;
2375
2376 switch (FC_TYPE(fc)) {
2377 case T_MGMT:
2378 if (!mgmt_body_print(fc,
2379 (const struct mgmt_header_t *)(p - hdrlen), p, length)) {
2380 printf("%s", tstr);
2381 return hdrlen;
2382 }
2383 break;
2384 case T_CTRL:
2385 if (!ctrl_body_print(fc, p - hdrlen)) {
2386 printf("%s", tstr);
2387 return hdrlen;
2388 }
2389 break;
2390 case T_DATA:
2391 if (DATA_FRAME_IS_NULL(FC_SUBTYPE(fc)))
2392 return hdrlen; /* no-data frame */
2393 /* There may be a problem w/ AP not having this bit set */
2394 if (FC_WEP(fc)) {
2395 if (!wep_print(p)) {
2396 printf("%s", tstr);
2397 return hdrlen;
2398 }
2399 } else if (llc_print(p, length, caplen, dst, src,
2400 &extracted_ethertype) == 0) {
2401 /*
2402 * Some kinds of LLC packet we cannot
2403 * handle intelligently
2404 */
2405 if (!eflag)
2406 ieee_802_11_hdr_print(fc, p - hdrlen, hdrlen,
2407 meshdrlen, NULL, NULL);
2408 if (extracted_ethertype)
2409 printf("(LLC %s) ",
2410 etherproto_string(
2411 htons(extracted_ethertype)));
2412 if (!suppress_default_print)
2413 default_print(p, caplen);
2414 }
2415 break;
2416 default:
2417 printf("unknown 802.11 frame type (%d)", FC_TYPE(fc));
2418 break;
2419 }
2420
2421 return hdrlen;
2422 }
2423
2424 /*
2425 * This is the top level routine of the printer. 'p' points
2426 * to the 802.11 header of the packet, 'h->ts' is the timestamp,
2427 * 'h->len' is the length of the packet off the wire, and 'h->caplen'
2428 * is the number of bytes actually captured.
2429 */
2430 u_int
2431 ieee802_11_if_print(const struct pcap_pkthdr *h, const u_char *p)
2432 {
2433 return ieee802_11_print(p, h->len, h->caplen, 0, 0);
2434 }
2435
2436 #define IEEE80211_CHAN_FHSS \
2437 (IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_GFSK)
2438 #define IEEE80211_CHAN_A \
2439 (IEEE80211_CHAN_5GHZ | IEEE80211_CHAN_OFDM)
2440 #define IEEE80211_CHAN_B \
2441 (IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_CCK)
2442 #define IEEE80211_CHAN_PUREG \
2443 (IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_OFDM)
2444 #define IEEE80211_CHAN_G \
2445 (IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_DYN)
2446
2447 #define IS_CHAN_FHSS(flags) \
2448 ((flags & IEEE80211_CHAN_FHSS) == IEEE80211_CHAN_FHSS)
2449 #define IS_CHAN_A(flags) \
2450 ((flags & IEEE80211_CHAN_A) == IEEE80211_CHAN_A)
2451 #define IS_CHAN_B(flags) \
2452 ((flags & IEEE80211_CHAN_B) == IEEE80211_CHAN_B)
2453 #define IS_CHAN_PUREG(flags) \
2454 ((flags & IEEE80211_CHAN_PUREG) == IEEE80211_CHAN_PUREG)
2455 #define IS_CHAN_G(flags) \
2456 ((flags & IEEE80211_CHAN_G) == IEEE80211_CHAN_G)
2457 #define IS_CHAN_ANYG(flags) \
2458 (IS_CHAN_PUREG(flags) || IS_CHAN_G(flags))
2459
2460 static void
2461 print_chaninfo(int freq, int flags)
2462 {
2463 printf("%u MHz", freq);
2464 if (IS_CHAN_FHSS(flags))
2465 printf(" FHSS");
2466 if (IS_CHAN_A(flags)) {
2467 if (flags & IEEE80211_CHAN_HALF)
2468 printf(" 11a/10Mhz");
2469 else if (flags & IEEE80211_CHAN_QUARTER)
2470 printf(" 11a/5Mhz");
2471 else
2472 printf(" 11a");
2473 }
2474 if (IS_CHAN_ANYG(flags)) {
2475 if (flags & IEEE80211_CHAN_HALF)
2476 printf(" 11g/10Mhz");
2477 else if (flags & IEEE80211_CHAN_QUARTER)
2478 printf(" 11g/5Mhz");
2479 else
2480 printf(" 11g");
2481 } else if (IS_CHAN_B(flags))
2482 printf(" 11b");
2483 if (flags & IEEE80211_CHAN_TURBO)
2484 printf(" Turbo");
2485 if (flags & IEEE80211_CHAN_HT20)
2486 printf(" ht/20");
2487 else if (flags & IEEE80211_CHAN_HT40D)
2488 printf(" ht/40-");
2489 else if (flags & IEEE80211_CHAN_HT40U)
2490 printf(" ht/40+");
2491 printf(" ");
2492 }
2493
2494 static int
2495 print_radiotap_field(struct cpack_state *s, u_int32_t bit, u_int8_t *flags,
2496 struct radiotap_state *state, u_int32_t presentflags)
2497 {
2498 union {
2499 int8_t i8;
2500 u_int8_t u8;
2501 int16_t i16;
2502 u_int16_t u16;
2503 u_int32_t u32;
2504 u_int64_t u64;
2505 } u, u2, u3, u4;
2506 int rc;
2507
2508 switch (bit) {
2509 case IEEE80211_RADIOTAP_FLAGS:
2510 rc = cpack_uint8(s, &u.u8);
2511 if (rc != 0)
2512 break;
2513 *flags = u.u8;
2514 break;
2515 case IEEE80211_RADIOTAP_RATE:
2516 rc = cpack_uint8(s, &u.u8);
2517 if (rc != 0)
2518 break;
2519
2520 /* Save state rate */
2521 state->rate = u.u8;
2522 break;
2523 case IEEE80211_RADIOTAP_DB_ANTSIGNAL:
2524 case IEEE80211_RADIOTAP_DB_ANTNOISE:
2525 case IEEE80211_RADIOTAP_ANTENNA:
2526 rc = cpack_uint8(s, &u.u8);
2527 break;
2528 case IEEE80211_RADIOTAP_DBM_ANTSIGNAL:
2529 case IEEE80211_RADIOTAP_DBM_ANTNOISE:
2530 rc = cpack_int8(s, &u.i8);
2531 break;
2532 case IEEE80211_RADIOTAP_CHANNEL:
2533 rc = cpack_uint16(s, &u.u16);
2534 if (rc != 0)
2535 break;
2536 rc = cpack_uint16(s, &u2.u16);
2537 break;
2538 case IEEE80211_RADIOTAP_FHSS:
2539 case IEEE80211_RADIOTAP_LOCK_QUALITY:
2540 case IEEE80211_RADIOTAP_TX_ATTENUATION:
2541 case IEEE80211_RADIOTAP_RX_FLAGS:
2542 rc = cpack_uint16(s, &u.u16);
2543 break;
2544 case IEEE80211_RADIOTAP_DB_TX_ATTENUATION:
2545 rc = cpack_uint8(s, &u.u8);
2546 break;
2547 case IEEE80211_RADIOTAP_DBM_TX_POWER:
2548 rc = cpack_int8(s, &u.i8);
2549 break;
2550 case IEEE80211_RADIOTAP_TSFT:
2551 rc = cpack_uint64(s, &u.u64);
2552 break;
2553 case IEEE80211_RADIOTAP_XCHANNEL:
2554 rc = cpack_uint32(s, &u.u32);
2555 if (rc != 0)
2556 break;
2557 rc = cpack_uint16(s, &u2.u16);
2558 if (rc != 0)
2559 break;
2560 rc = cpack_uint8(s, &u3.u8);
2561 if (rc != 0)
2562 break;
2563 rc = cpack_uint8(s, &u4.u8);
2564 break;
2565 case IEEE80211_RADIOTAP_MCS:
2566 rc = cpack_uint8(s, &u.u8);
2567 if (rc != 0)
2568 break;
2569 rc = cpack_uint8(s, &u2.u8);
2570 if (rc != 0)
2571 break;
2572 rc = cpack_uint8(s, &u3.u8);
2573 break;
2574 case IEEE80211_RADIOTAP_VENDOR_NAMESPACE: {
2575 u_int8_t vns[3];
2576 u_int16_t length;
2577 u_int8_t subspace;
2578
2579 if ((cpack_align_and_reserve(s, 2)) == NULL) {
2580 rc = -1;
2581 break;
2582 }
2583
2584 rc = cpack_uint8(s, &vns[0]);
2585 if (rc != 0)
2586 break;
2587 rc = cpack_uint8(s, &vns[1]);
2588 if (rc != 0)
2589 break;
2590 rc = cpack_uint8(s, &vns[2]);
2591 if (rc != 0)
2592 break;
2593 rc = cpack_uint8(s, &subspace);
2594 if (rc != 0)
2595 break;
2596 rc = cpack_uint16(s, &length);
2597 if (rc != 0)
2598 break;
2599
2600 /* Skip up to length */
2601 s->c_next += length;
2602 break;
2603 }
2604 default:
2605 /* this bit indicates a field whose
2606 * size we do not know, so we cannot
2607 * proceed. Just print the bit number.
2608 */
2609 printf("[bit %u] ", bit);
2610 return -1;
2611 }
2612
2613 if (rc != 0) {
2614 printf("%s", tstr);
2615 return rc;
2616 }
2617
2618 /* Preserve the state present flags */
2619 state->present = presentflags;
2620
2621 switch (bit) {
2622 case IEEE80211_RADIOTAP_CHANNEL:
2623 /*
2624 * If CHANNEL and XCHANNEL are both present, skip
2625 * CHANNEL.
2626 */
2627 if (presentflags & (1 << IEEE80211_RADIOTAP_XCHANNEL))
2628 break;
2629 print_chaninfo(u.u16, u2.u16);
2630 break;
2631 case IEEE80211_RADIOTAP_FHSS:
2632 printf("fhset %d fhpat %d ", u.u16 & 0xff, (u.u16 >> 8) & 0xff);
2633 break;
2634 case IEEE80211_RADIOTAP_RATE:
2635 /*
2636 * XXX On FreeBSD rate & 0x80 means we have an MCS. On
2637 * Linux and AirPcap it does not. (What about
2638 * Mac OS X, NetBSD, OpenBSD, and DragonFly BSD?)
2639 *
2640 * This is an issue either for proprietary extensions
2641 * to 11a or 11g, which do exist, or for 11n
2642 * implementations that stuff a rate value into
2643 * this field, which also appear to exist.
2644 *
2645 * We currently handle that by assuming that
2646 * if the 0x80 bit is set *and* the remaining
2647 * bits have a value between 0 and 15 it's
2648 * an MCS value, otherwise it's a rate. If
2649 * there are cases where systems that use
2650 * "0x80 + MCS index" for MCS indices > 15,
2651 * or stuff a rate value here between 64 and
2652 * 71.5 Mb/s in here, we'll need a preference
2653 * setting. Such rates do exist, e.g. 11n
2654 * MCS 7 at 20 MHz with a long guard interval.
2655 */
2656 if (u.u8 >= 0x80 && u.u8 <= 0x8f) {
2657 /*
2658 * XXX - we don't know the channel width
2659 * or guard interval length, so we can't
2660 * convert this to a data rate.
2661 *
2662 * If you want us to show a data rate,
2663 * use the MCS field, not the Rate field;
2664 * the MCS field includes not only the
2665 * MCS index, it also includes bandwidth
2666 * and guard interval information.
2667 *
2668 * XXX - can we get the channel width
2669 * from XChannel and the guard interval
2670 * information from Flags, at least on
2671 * FreeBSD?
2672 */
2673 printf("MCS %u ", u.u8 & 0x7f);
2674 } else
2675 printf("%2.1f Mb/s ", .5*u.u8);
2676 break;
2677 case IEEE80211_RADIOTAP_DBM_ANTSIGNAL:
2678 printf("%ddB signal ", u.i8);
2679 break;
2680 case IEEE80211_RADIOTAP_DBM_ANTNOISE:
2681 printf("%ddB noise ", u.i8);
2682 break;
2683 case IEEE80211_RADIOTAP_DB_ANTSIGNAL:
2684 printf("%ddB signal ", u.u8);
2685 break;
2686 case IEEE80211_RADIOTAP_DB_ANTNOISE:
2687 printf("%ddB noise ", u.u8);
2688 break;
2689 case IEEE80211_RADIOTAP_LOCK_QUALITY:
2690 printf("%u sq ", u.u16);
2691 break;
2692 case IEEE80211_RADIOTAP_TX_ATTENUATION:
2693 printf("%d tx power ", -(int)u.u16);
2694 break;
2695 case IEEE80211_RADIOTAP_DB_TX_ATTENUATION:
2696 printf("%ddB tx power ", -(int)u.u8);
2697 break;
2698 case IEEE80211_RADIOTAP_DBM_TX_POWER:
2699 printf("%ddBm tx power ", u.i8);
2700 break;
2701 case IEEE80211_RADIOTAP_FLAGS:
2702 if (u.u8 & IEEE80211_RADIOTAP_F_CFP)
2703 printf("cfp ");
2704 if (u.u8 & IEEE80211_RADIOTAP_F_SHORTPRE)
2705 printf("short preamble ");
2706 if (u.u8 & IEEE80211_RADIOTAP_F_WEP)
2707 printf("wep ");
2708 if (u.u8 & IEEE80211_RADIOTAP_F_FRAG)
2709 printf("fragmented ");
2710 if (u.u8 & IEEE80211_RADIOTAP_F_BADFCS)
2711 printf("bad-fcs ");
2712 break;
2713 case IEEE80211_RADIOTAP_ANTENNA:
2714 printf("antenna %d ", u.u8);
2715 break;
2716 case IEEE80211_RADIOTAP_TSFT:
2717 printf("%" PRIu64 "us tsft ", u.u64);
2718 break;
2719 case IEEE80211_RADIOTAP_RX_FLAGS:
2720 /* Do nothing for now */
2721 break;
2722 case IEEE80211_RADIOTAP_XCHANNEL:
2723 print_chaninfo(u2.u16, u.u32);
2724 break;
2725 case IEEE80211_RADIOTAP_MCS: {
2726 static const char *bandwidth[4] = {
2727 "20 MHz",
2728 "40 MHz",
2729 "20 MHz (L)",
2730 "20 MHz (U)"
2731 };
2732 float htrate;
2733
2734 if (u.u8 & IEEE80211_RADIOTAP_MCS_MCS_INDEX_KNOWN) {
2735 /*
2736 * We know the MCS index.
2737 */
2738 if (u3.u8 <= MAX_MCS_INDEX) {
2739 /*
2740 * And it's in-range.
2741 */
2742 if (u.u8 & (IEEE80211_RADIOTAP_MCS_BANDWIDTH_KNOWN|IEEE80211_RADIOTAP_MCS_GUARD_INTERVAL_KNOWN)) {
2743 /*
2744 * And we know both the bandwidth and
2745 * the guard interval, so we can look
2746 * up the rate.
2747 */
2748 htrate =
2749 ieee80211_float_htrates \
2750 [u3.u8] \
2751 [((u2.u8 & IEEE80211_RADIOTAP_MCS_BANDWIDTH_MASK) == IEEE80211_RADIOTAP_MCS_BANDWIDTH_40 ? 1 : 0)] \
2752 [((u2.u8 & IEEE80211_RADIOTAP_MCS_SHORT_GI) ? 1 : 0)];
2753 } else {
2754 /*
2755 * We don't know both the bandwidth
2756 * and the guard interval, so we can
2757 * only report the MCS index.
2758 */
2759 htrate = 0.0;
2760 }
2761 } else {
2762 /*
2763 * The MCS value is out of range.
2764 */
2765 htrate = 0.0;
2766 }
2767 if (htrate != 0.0) {
2768 /*
2769 * We have the rate.
2770 * Print it.
2771 */
2772 printf("%.1f Mb/s MCS %u ", htrate, u3.u8);
2773 } else {
2774 /*
2775 * We at least have the MCS index.
2776 * Print it.
2777 */
2778 printf("MCS %u ", u3.u8);
2779 }
2780 }
2781 if (u.u8 & IEEE80211_RADIOTAP_MCS_BANDWIDTH_KNOWN) {
2782 printf("%s ",
2783 bandwidth[u2.u8 & IEEE80211_RADIOTAP_MCS_BANDWIDTH_MASK]);
2784 }
2785 if (u.u8 & IEEE80211_RADIOTAP_MCS_GUARD_INTERVAL_KNOWN) {
2786 printf("%s GI ",
2787 (u2.u8 & IEEE80211_RADIOTAP_MCS_SHORT_GI) ?
2788 "short" : "lon");
2789 }
2790 if (u.u8 & IEEE80211_RADIOTAP_MCS_HT_FORMAT_KNOWN) {
2791 printf("%s ",
2792 (u2.u8 & IEEE80211_RADIOTAP_MCS_HT_GREENFIELD) ?
2793 "greenfield" : "mixed");
2794 }
2795 if (u.u8 & IEEE80211_RADIOTAP_MCS_FEC_TYPE_KNOWN) {
2796 printf("%s FEC ",
2797 (u2.u8 & IEEE80211_RADIOTAP_MCS_FEC_LDPC) ?
2798 "LDPC" : "BCC");
2799 }
2800 if (u.u8 & IEEE80211_RADIOTAP_MCS_STBC_KNOWN) {
2801 printf("RX-STBC%u ",
2802 (u2.u8 & IEEE80211_RADIOTAP_MCS_STBC_MASK) >> IEEE80211_RADIOTAP_MCS_STBC_SHIFT);
2803 }
2804
2805 break;
2806 }
2807 }
2808 return 0;
2809 }
2810
2811 static u_int
2812 ieee802_11_radio_print(const u_char *p, u_int length, u_int caplen)
2813 {
2814 #define BITNO_32(x) (((x) >> 16) ? 16 + BITNO_16((x) >> 16) : BITNO_16((x)))
2815 #define BITNO_16(x) (((x) >> 8) ? 8 + BITNO_8((x) >> 8) : BITNO_8((x)))
2816 #define BITNO_8(x) (((x) >> 4) ? 4 + BITNO_4((x) >> 4) : BITNO_4((x)))
2817 #define BITNO_4(x) (((x) >> 2) ? 2 + BITNO_2((x) >> 2) : BITNO_2((x)))
2818 #define BITNO_2(x) (((x) & 2) ? 1 : 0)
2819 #define BIT(n) (1U << n)
2820 #define IS_EXTENDED(__p) \
2821 (EXTRACT_LE_32BITS(__p) & BIT(IEEE80211_RADIOTAP_EXT)) != 0
2822
2823 struct cpack_state cpacker;
2824 struct ieee80211_radiotap_header *hdr;
2825 u_int32_t present, next_present;
2826 u_int32_t presentflags = 0;
2827 u_int32_t *presentp, *last_presentp;
2828 enum ieee80211_radiotap_type bit;
2829 int bit0;
2830 u_int len;
2831 u_int8_t flags;
2832 int pad;
2833 u_int fcslen;
2834 struct radiotap_state state;
2835
2836 if (caplen < sizeof(*hdr)) {
2837 printf("%s", tstr);
2838 return caplen;
2839 }
2840
2841 hdr = (struct ieee80211_radiotap_header *)p;
2842
2843 len = EXTRACT_LE_16BITS(&hdr->it_len);
2844
2845 if (caplen < len) {
2846 printf("%s", tstr);
2847 return caplen;
2848 }
2849 cpack_init(&cpacker, (u_int8_t *)hdr, len); /* align against header start */
2850 cpack_advance(&cpacker, sizeof(*hdr)); /* includes the 1st bitmap */
2851 for (last_presentp = &hdr->it_present;
2852 IS_EXTENDED(last_presentp) &&
2853 (u_char*)(last_presentp + 1) <= p + len;
2854 last_presentp++)
2855 cpack_advance(&cpacker, sizeof(hdr->it_present)); /* more bitmaps */
2856
2857 /* are there more bitmap extensions than bytes in header? */
2858 if (IS_EXTENDED(last_presentp)) {
2859 printf("%s", tstr);
2860 return caplen;
2861 }
2862
2863 /* Assume no flags */
2864 flags = 0;
2865 /* Assume no Atheros padding between 802.11 header and body */
2866 pad = 0;
2867 /* Assume no FCS at end of frame */
2868 fcslen = 0;
2869 for (bit0 = 0, presentp = &hdr->it_present; presentp <= last_presentp;
2870 presentp++, bit0 += 32) {
2871 presentflags = EXTRACT_LE_32BITS(presentp);
2872
2873 /* Clear state. */
2874 memset(&state, 0, sizeof(state));
2875
2876 for (present = EXTRACT_LE_32BITS(presentp); present;
2877 present = next_present) {
2878 /* clear the least significant bit that is set */
2879 next_present = present & (present - 1);
2880
2881 /* extract the least significant bit that is set */
2882 bit = (enum ieee80211_radiotap_type)
2883 (bit0 + BITNO_32(present ^ next_present));
2884
2885 if (print_radiotap_field(&cpacker, bit, &flags, &state, presentflags) != 0)
2886 goto out;
2887 }
2888 }
2889
2890 out:
2891 if (flags & IEEE80211_RADIOTAP_F_DATAPAD)
2892 pad = 1; /* Atheros padding */
2893 if (flags & IEEE80211_RADIOTAP_F_FCS)
2894 fcslen = 4; /* FCS at end of packet */
2895 return len + ieee802_11_print(p + len, length - len, caplen - len, pad,
2896 fcslen);
2897 #undef BITNO_32
2898 #undef BITNO_16
2899 #undef BITNO_8
2900 #undef BITNO_4
2901 #undef BITNO_2
2902 #undef BIT
2903 }
2904
2905 static u_int
2906 ieee802_11_avs_radio_print(const u_char *p, u_int length, u_int caplen)
2907 {
2908 u_int32_t caphdr_len;
2909
2910 if (caplen < 8) {
2911 printf("%s", tstr);
2912 return caplen;
2913 }
2914
2915 caphdr_len = EXTRACT_32BITS(p + 4);
2916 if (caphdr_len < 8) {
2917 /*
2918 * Yow! The capture header length is claimed not
2919 * to be large enough to include even the version
2920 * cookie or capture header length!
2921 */
2922 printf("%s", tstr);
2923 return caplen;
2924 }
2925
2926 if (caplen < caphdr_len) {
2927 printf("%s", tstr);
2928 return caplen;
2929 }
2930
2931 return caphdr_len + ieee802_11_print(p + caphdr_len,
2932 length - caphdr_len, caplen - caphdr_len, 0, 0);
2933 }
2934
2935 #define PRISM_HDR_LEN 144
2936
2937 #define WLANCAP_MAGIC_COOKIE_BASE 0x80211000
2938 #define WLANCAP_MAGIC_COOKIE_V1 0x80211001
2939 #define WLANCAP_MAGIC_COOKIE_V2 0x80211002
2940
2941 /*
2942 * For DLT_PRISM_HEADER; like DLT_IEEE802_11, but with an extra header,
2943 * containing information such as radio information, which we
2944 * currently ignore.
2945 *
2946 * If, however, the packet begins with WLANCAP_MAGIC_COOKIE_V1 or
2947 * WLANCAP_MAGIC_COOKIE_V2, it's really DLT_IEEE802_11_RADIO_AVS
2948 * (currently, on Linux, there's no ARPHRD_ type for
2949 * DLT_IEEE802_11_RADIO_AVS, as there is a ARPHRD_IEEE80211_PRISM
2950 * for DLT_PRISM_HEADER, so ARPHRD_IEEE80211_PRISM is used for
2951 * the AVS header, and the first 4 bytes of the header are used to
2952 * indicate whether it's a Prism header or an AVS header).
2953 */
2954 u_int
2955 prism_if_print(const struct pcap_pkthdr *h, const u_char *p)
2956 {
2957 u_int caplen = h->caplen;
2958 u_int length = h->len;
2959 u_int32_t msgcode;
2960
2961 if (caplen < 4) {
2962 printf("%s", tstr);
2963 return caplen;
2964 }
2965
2966 msgcode = EXTRACT_32BITS(p);
2967 if (msgcode == WLANCAP_MAGIC_COOKIE_V1 ||
2968 msgcode == WLANCAP_MAGIC_COOKIE_V2)
2969 return ieee802_11_avs_radio_print(p, length, caplen);
2970
2971 if (caplen < PRISM_HDR_LEN) {
2972 printf("%s", tstr);
2973 return caplen;
2974 }
2975
2976 return PRISM_HDR_LEN + ieee802_11_print(p + PRISM_HDR_LEN,
2977 length - PRISM_HDR_LEN, caplen - PRISM_HDR_LEN, 0, 0);
2978 }
2979
2980 /*
2981 * For DLT_IEEE802_11_RADIO; like DLT_IEEE802_11, but with an extra
2982 * header, containing information such as radio information.
2983 */
2984 u_int
2985 ieee802_11_radio_if_print(const struct pcap_pkthdr *h, const u_char *p)
2986 {
2987 return ieee802_11_radio_print(p, h->len, h->caplen);
2988 }
2989
2990 /*
2991 * For DLT_IEEE802_11_RADIO_AVS; like DLT_IEEE802_11, but with an
2992 * extra header, containing information such as radio information,
2993 * which we currently ignore.
2994 */
2995 u_int
2996 ieee802_11_radio_avs_if_print(const struct pcap_pkthdr *h, const u_char *p)
2997 {
2998 return ieee802_11_avs_radio_print(p, h->len, h->caplen);
2999 }
[mirror] the TCPdump network dissector