LINKTYPE_IEEE802_11_PRISM

Packet structure

+-------------+
|    Msgcode  |
|  (4 Octets) |
+-------------+
|    Msglen   |
|  (4 Octets) |
+-------------+
| Device name |
| (16 Octets) |
+------------++-----------+------------+------------+
|     DID    |   Status   |   Length   |    Data    |
| (4 Octets) | (2 Octets) | (2 Octets) | (n Octets) |
+------------+------------+------------+------------+
.                                                   .
.                                                   .
.                                                   .
+---------------------------------------------------+
|                      Payload                      |
.                                                   .
.                                                   .
.                                                   .

Description

All fields are in the host byte order of the machine on which the capture was done. (In practice, this is likely to be little-endian, but that's not guaranteed.)

The msgcode field either has the value 0x00000041 or the value 0x00000044. The msglen field is the length of the entire Prism header. In practice, it is almost always, if not always, 144 octets. The device name is the interface name of the adapter.

There could be, in theory, zero or more instances of the {DID, Status, Length, Data} quadruplet; in practice, there are almost always, if not always, 10 instances. Each quadruplet represents the value of a parameter. The DID field indicates what the parameter is. For packets with the msgcode value 0x00000041, the DID field values are:

• 0x00001041 - host time;
• 0x00002041 - MAC time;
• 0x00003041 - channel;
• 0x00004041 - RSSI;
• 0x00005041 - signal quality;
• 0x00006041 - signal;
• 0x00007041 - noise;
• 0x00008041 - rate;
• 0x00009041 - transmitted frame indicator;
• 0x0000A041 - frame length.

For packets with the msgcode value 0x00000044, the DID field values are:

• 0x00010044 - host time;
• 0x00020044 - MAC time;
• 0x00030044 - channel;
• 0x00040044 - RSSI;
• 0x00050044 - signal quality;
• 0x00060044 - signal;
• 0x00070044 - noise;
• 0x00080044 - rate;
• 0x00090044 - transmitted frame indicator;
• 0x000A0044 - frame length.

The Status field is 0 if the value of that parameter is supplied and 1 if it is not supplied. The Length field indicates the length of the following Data field; in theory, it could have any value, but it is almost always, if not always, 4. The Data field contains the value of the parameter.

The representation of the values may differ between different network adapters. There is no official specification for the Prism header; this person's page on the Prism header describes what he found from examining some adapter drivers.

文章原址：link