Radiotap - IEEE 802.11 Radiotap Header

pcapkit.protocols.link.radiotap contains Radiotap only, which implements the extractor for the radiotap header [*] capture tools prepend to an 802.11 frame, as seen on a LINKTYPE_IEEE802_11_RADIOTAP capture, or on a LINKTYPE_LINUX_SLL/LINKTYPE_LINUX_SLL2 capture whose arphrd_type is ARPHRD_IEEE80211_RADIOTAP. Radiotap is not part of the 802.11 standard itself – it is a prefix written by the capturing tool, in front of the raw 802.11 MAC frame. Its fixed start, all little-endian, is described as below:

Octets	Bits	Name	Description
0	0	radiotap.it_version	Header Revision (always 0)
1	8	radiotap.it_pad	Padding
2	16	radiotap.it_len	Header Length (header included)
4	32	radiotap.it_present	First Present-Flags Word

followed by a chain of further present-flags words – bit 31 of a word signals that another follows – and then the optional-field region those bitmasks select, each field aligned and sized per its own type. it_len bounds the whole of it; the 802.11 MAC frame starts at that offset.

Scope

This class:

• Decodes the fixed 8-octet start – it_version, it_pad, it_len – and walks the present-flags chain, recording every word as present.

• Keeps the optional-field region those bits select whole, as fields, which is what a rebuild from the data model writes, and decodes it as decoded, by the rules below.

• Hands everything from it_len on, the 802.11 MAC frame, to IEEE802_11 (NoPayload when nothing follows). The header names no next protocol, since an 802.11 frame always follows it, so the frame is looked up in Radiotap.__proto__ under LinkType.IEEE802_11; register_radiotap() replaces the entry.

Field Decoding

The bits are walked in order, word by word, and the fields they select follow one another in the same order, each aligned to its own boundary counted from the start of the header. A field type is read and made by the methods Radiotap.__field__ names for it, through the schema the RadiotapField registry holds for it: the schema’s fields are the subfields of the type’s page on radiotap.org, their total is its size, and its __align__ its alignment, which match the tables of the Linux kernel, Wireshark and radiotap.org’s own radiotap-library wherever they size it. A page that names no alignment takes that of its subfields, single octets, but for FHSS, which those three align to 2. The fields are radiotap.org’s defined ones, and RTS retries and data retries, bits 16 and 17, from its unofficially used ones, which those three size alike; OpenBSD writes a 2-octet RSSI field at bit 16 instead, which is not read. A bitmap radiotap.org defines bit by bit is a member of its flag registry under pcapkit.const.radiotap, which keeps the bits it does not name. A bitmap that mixes value subfields with known bits – the MCS flags, the HE data1 and data2, the HE-MU flags1 and flags2 and the U-SIG common – is split: each value subfield is an integer, and its other bits, the undefined ones among them, a member of its known-bits registry. A field type registered through register_radiotap_field() is decoded the same way.

• Namespaces. Bits 29 and 30 mean the same in every word. Bit 29, the Radiotap Namespace field, carries nothing, and the next word restarts the radiotap namespace at bit 0. Bit 30, the Vendor Namespace field, carries an OUI, a sub-namespace and a skip_length; the words up to the next namespace field select vendor fields, whose data is the skip_length octets after it, kept whole. Without either, the next word continues the namespace, each bit numbered 32 past the same bit of the word before.

• TLVs. Bit 28 makes the rest of the region a list of type-length-value items. An item’s data is decoded where its type has a schema it does not run past, and kept raw otherwise; a vendor item is split into its header and raw data. radiotap.org lets a producer leave out the octets that end an item, which are then zeros, so an item short of its schema, or of the vendor header, is decoded as though they were there. Its decoded data records the cut as __short_read__, as Schema.unpack does, so Radiotap.make writes the octets that were captured.

• What is not decoded. A radiotap-namespace bit no field is defined for – 18, FreeBSD’s XChannel, which radiotap.org lists as unofficial, and every one numbered 32 or more, the TLV-only types included – or a field that runs past the region, ends the walk, since nothing after it can be located: an Unknown entry keeps every octet from there on, and its reason says which of the two it was.

Each bit with data in the radiotap namespace, and each namespace field, has one entry in decoded, keyed by its FieldType; the subfields keep radiotap.org’s names. make() takes the same entries as fields and encodes them with zero padding.

class pcapkit.protocols.link.radiotap.Radiotap(file=None, length=None, **kwargs)

Bases: Link[Radiotap, Radiotap]

This class implements the IEEE 802.11 radiotap header.

The 802.11 MAC frame this header precedes is dispatched through the registry below, keyed by the link type of the frame:

Index	Protocol
IEEE802_11	pcapkit.protocols.link.ieee802_11.IEEE802_11

and each field of the field-data region through __field__, keyed by its FieldType. See the module docstring’s Scope and Field Decoding sections for what is, and is not, decoded.

property name: Literal['Radiotap']

Name of current protocol.

property alias: Literal['Radiotap']

Acronym of corresponding protocol.

property length: int

Header length of current protocol.

This is self._info.it_len exactly as captured, even when it disagrees with present and fields – see read().

classmethod id()

Index ID of the protocol.

Return type:

tuple[Literal['Radiotap']]

read(length=None, **kwargs)

Read IEEE 802.11 radiotap header.

Structure of the fixed start this class dissects, all little-endian:

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|   it_version  |    it_pad     |            it_len             |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                           it_present                         |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

followed, while the previous word’s bit 31 is set, by a further it_present word, then by the field-data region those bits select, then by the 802.11 MAC frame at offset it_len.

The region is decoded into decoded as the module docstring’s Field Decoding section describes: one entry per bit that selects radiotap-namespace data or switches namespace, keyed by its FieldType. A bit in a vendor namespace has no entry of its own, since its data is in the VendorNamespace entry, and nothing after the TLV fields or an Unknown entry has one. Octets after the last field stay in fields alone.

Parameters:

• length (int | None) – Length of packet data.

• **kwargs (Any) – Arbitrary keyword arguments.

Return type:

Radiotap

Returns:

Parsed packet data.

make(it_version=0, it_pad=0, present=(0,), fields=b'', it_len=None, payload=b'', **kwargs)

Make (construct) packet data.

Parameters:

• it_version (int) – Header revision.

• it_pad (int) – Padding octet.

• present (Sequence[int]) – Every present-flags word, in order; the first is the mandatory one radiotap.org calls it_present, and each but the last conventionally has bit 31 set (not enforced for raw fields, so a capture that read short of its own chain replays exactly: see the Note on FRAD.make for the same tolerance).

• fields (bytes | Mapping[FieldType | int, RadiotapField | Mapping[str, Any]] | Sequence[RadiotapField | Tuple[FieldType | int, Mapping[str, Any]]]) – The optional-field region present selects: the raw octets, written as they are, or its fields, which are encoded with zero padding. Fields are given as decoded holds them, or as a sequence of data models or (type, mapping) pairs, a type being a FieldType or an int. There is one per bit read() gives an entry for, in the same order, and an Unknown one, or one of a type no field is defined for, is written raw and ends the region.

• it_len (int | None) – Total header length, header included; computed from present and fields when omitted.

• payload (bytes | ProtocolBase | Schema) – Payload data (the 802.11 MAC frame).

• **kwargs (Any) – Arbitrary keyword arguments.

Return type:

Radiotap

Returns:

Constructed packet data.

Raises:

ProtocolError – If it_version or it_pad does not fit in 8 bits; if present is empty or any of its words does not fit in 32 bits; if fields is neither bytes nor fields; if the fields do not match the bits of present, a word but the last of which ends the chain, or a value does not fit its subfield; if a TLV item’s __short_read__ names no field and an octet count, or cuts short a vendor header that data follows; or if it_len is given and does not fit in 16 bits.

classmethod register(code, protocol)

Register a new protocol class for the frame a radiotap header precedes.

Notes

The fully qualified class name of the new protocol class should be {protocol.module}.{protocol.name}.

Parameters:

• code (LinkType) – link type as in LinkType

• protocol (ModuleDescriptor[ProtocolBase] | Type[ProtocolBase]) – module descriptor or a ProtocolBase subclass

Important

This overrides Link.register because self.__proto__ is keyed by link type rather than by EtherType. Any link type is accepted, but read() consults LinkType.IEEE802_11 alone: that is the key a replacement 802.11 dissector takes, and an entry under any other key is stored and never reached.

Raises:

pcapkit.utilities.exceptions.RegistryError – If protocol is not a class, or not a ProtocolBase subclass.

Warns:

pcapkit.utilities.warnings.RegistryWarning – If this link type is already registered and the incumbent differs from the replacement; see Protocol.register for the guard, and for the shipped descriptor a restore puts back (#1504).

classmethod register_field(code, meth)

Register a field parser.

Parameters:

• code (FieldType) – Radiotap field type.

• meth (str | tuple[Callable[[FieldType, RadiotapField], RadiotapField], Callable[[FieldType, RadiotapField | Mapping[str, Any]], RadiotapField]]) – Method name, or a (parser, constructor) pair of callables, to parse and construct the field; see __field__.

Warns:

RegistryWarning – If a different entry is already registered for code; it is overwritten. Handing back the entry already stored, or one equal to it, is a silent no-op. Re-registering the entry code shipped with is accepted like any other, so an override can be undone (#1362, #1363).

__length_hint__()

Return an estimated length for the object.

The fixed start alone, 8 – the shortest a radiotap header can structurally be (an empty present-flags word, no extended words, no field data). A capture shorter than this is not a radiotap header at all, so it is kept as Raw rather than parsed; see Protocol._parse_next_layer.

Return type:

Literal[8]

classmethod __index__()

Numeral registry index of the protocol.

Return type:

LinkType

Returns:

Numeral registry index of the protocol in tcpdump link-layer header types. LinuxSLL.__proto__ names its own key for this class, ARPHRD_IEEE80211_RADIOTAP (The Registry Index).

classmethod _make_data(data)

Create key-value pairs from data for protocol construction.

The field-data region is rebuilt from fields, the octets as captured, so padding, trailing octets and fields that were not decoded come back exactly; an edit to decoded takes a make() call that passes it as fields.

Parameters:

data (Radiotap) – protocol data

Return type:

dict[str, Any]

Returns:

Key-value pairs for protocol construction.

_read_radiotap_fields(present, fields)

Decode the field-data region.

Parameters:

• present (Sequence[int]) – Every present-flags word read.

• fields (bytes) – The field-data region.

Return type:

OrderedMultiDict[FieldType, RadiotapField]

Returns:

The decoded fields, as read() describes them.

_make_radiotap_fields(present, fields)

Encode the field-data region, the inverse of _read_radiotap_fields().

Parameters:

• present (Sequence[int]) – Every present-flags word.

• fields (Mapping[FieldType | int, RadiotapField | Mapping[str, Any]] | Sequence[RadiotapField | Tuple[FieldType | int, Mapping[str, Any]]]) – The fields, as make() takes them.

Return type:

bytes

Returns:

The field-data region.

Raises:

ProtocolError – If the fields do not match the bits of present, a word but the last of which ends the chain, or a value does not fit its subfield.

_read_field_unknown(field_type, schema, *, reason=_REASON_NO_LAYOUT)

Read the octets of a field type with no layout, or of a field that runs past the field-data region.

Parameters:

• field_type (FieldType) – type of the field

• schema (Unknown) – parsed field schema, every octet to the end of the region

• reason (str) – why the field is not decoded

Return type:

Unknown

Returns:

Parsed field data.

_read_field_tsft(field_type, schema)

Read a TSFT field.

Parameters:

• field_type (FieldType) – type of the field

• schema (TSFT) – parsed field schema

Return type:

TSFT

Returns:

Parsed field data.

_read_field_flags(field_type, schema)

Read a Flags field.

Parameters:

• field_type (FieldType) – type of the field

• schema (Flags) – parsed field schema

Return type:

Flags

Returns:

Parsed field data.

_read_field_rate(field_type, schema)

Read a Rate field.

Parameters:

• field_type (FieldType) – type of the field

• schema (Rate) – parsed field schema

Return type:

Rate

Returns:

Parsed field data.

_read_field_channel(field_type, schema)

Read a Channel field.

Parameters:

• field_type (FieldType) – type of the field

• schema (Channel) – parsed field schema

Return type:

Channel

Returns:

Parsed field data.

_read_field_fhss(field_type, schema)

Read an FHSS field.

Parameters:

• field_type (FieldType) – type of the field

• schema (FHSS) – parsed field schema

Return type:

FHSS

Returns:

Parsed field data.

_read_field_antenna_signal(field_type, schema)

Read an Antenna signal field.

Parameters:

• field_type (FieldType) – type of the field

• schema (AntennaSignal) – parsed field schema

Return type:

AntennaSignal

Returns:

Parsed field data.

_read_field_antenna_noise(field_type, schema)

Read an Antenna noise field.

Parameters:

• field_type (FieldType) – type of the field

• schema (AntennaNoise) – parsed field schema

Return type:

AntennaNoise

Returns:

Parsed field data.

_read_field_lock_quality(field_type, schema)

Read a Lock quality field.

Parameters:

• field_type (FieldType) – type of the field

• schema (LockQuality) – parsed field schema

Return type:

LockQuality

Returns:

Parsed field data.

_read_field_tx_attenuation(field_type, schema)

Read a TX attenuation field.

Parameters:

• field_type (FieldType) – type of the field

• schema (TXAttenuation) – parsed field schema

Return type:

TXAttenuation

Returns:

Parsed field data.

_read_field_db_tx_attenuation(field_type, schema)

Read a dB TX attenuation field.

Parameters:

• field_type (FieldType) – type of the field

• schema (DBTXAttenuation) – parsed field schema

Return type:

DBTXAttenuation

Returns:

Parsed field data.

_read_field_dbm_tx_power(field_type, schema)

Read a dBm TX power field.

Parameters:

• field_type (FieldType) – type of the field

• schema (DBmTXPower) – parsed field schema

Return type:

DBmTXPower

Returns:

Parsed field data.

_read_field_antenna(field_type, schema)

Read an Antenna field.

Parameters:

• field_type (FieldType) – type of the field

• schema (Antenna) – parsed field schema

Return type:

Antenna

Returns:

Parsed field data.

_read_field_db_antenna_signal(field_type, schema)

Read a dB antenna signal field.

Parameters:

• field_type (FieldType) – type of the field

• schema (DBAntennaSignal) – parsed field schema

Return type:

DBAntennaSignal

Returns:

Parsed field data.

_read_field_db_antenna_noise(field_type, schema)

Read a dB antenna noise field.

Parameters:

• field_type (FieldType) – type of the field

• schema (DBAntennaNoise) – parsed field schema

Return type:

DBAntennaNoise

Returns:

Parsed field data.

_read_field_rx_flags(field_type, schema)

Read an RX flags field.

Parameters:

• field_type (FieldType) – type of the field

• schema (RXFlags) – parsed field schema

Return type:

RXFlags

Returns:

Parsed field data.

_read_field_tx_flags(field_type, schema)

Read a TX flags field.

Parameters:

• field_type (FieldType) – type of the field

• schema (TXFlags) – parsed field schema

Return type:

TXFlags

Returns:

Parsed field data.

_read_field_rts_retries(field_type, schema)

Read an RTS retries field.

Parameters:

• field_type (FieldType) – type of the field

• schema (RTSRetries) – parsed field schema

Return type:

RTSRetries

Returns:

Parsed field data.

_read_field_data_retries(field_type, schema)

Read a data retries field.

Parameters:

• field_type (FieldType) – type of the field

• schema (DataRetries) – parsed field schema

Return type:

DataRetries

Returns:

Parsed field data.

_read_field_mcs(field_type, schema)

Read an MCS field.

Parameters:

• field_type (FieldType) – type of the field

• schema (MCS) – parsed field schema

Return type:

MCS

Returns:

Parsed field data.

_read_field_ampdu_status(field_type, schema)

Read an A-MPDU status field.

Parameters:

• field_type (FieldType) – type of the field

• schema (AMPDUStatus) – parsed field schema

Return type:

AMPDUStatus

Returns:

Parsed field data.

_read_field_vht(field_type, schema)

Read a VHT field.

Parameters:

• field_type (FieldType) – type of the field

• schema (VHT) – parsed field schema

Return type:

VHT

Returns:

Parsed field data.

_read_field_timestamp(field_type, schema)

Read a timestamp field.

Parameters:

• field_type (FieldType) – type of the field

• schema (Timestamp) – parsed field schema

Return type:

Timestamp

Returns:

Parsed field data.

_read_field_he(field_type, schema)

Read an HE field.

Parameters:

• field_type (FieldType) – type of the field

• schema (HE) – parsed field schema

Return type:

HE

Returns:

Parsed field data.

_read_field_he_mu(field_type, schema)

Read an HE-MU field.

Parameters:

• field_type (FieldType) – type of the field

• schema (HEMU) – parsed field schema

Return type:

HEMU

Returns:

Parsed field data.

_read_field_he_mu_other_user(field_type, schema)

Read an HE-MU-other-user field.

Parameters:

• field_type (FieldType) – type of the field

• schema (HEMUOtherUser) – parsed field schema

Return type:

HEMUOtherUser

Returns:

Parsed field data.

_read_field_zero_length_psdu(field_type, schema)

Read a 0-length-PSDU field.

Parameters:

• field_type (FieldType) – type of the field

• schema (ZeroLengthPSDU) – parsed field schema

Return type:

ZeroLengthPSDU

Returns:

Parsed field data.

_read_field_lsig(field_type, schema)

Read an L-SIG field.

Parameters:

• field_type (FieldType) – type of the field

• schema (LSIG) – parsed field schema

Return type:

LSIG

Returns:

Parsed field data.

_read_field_s1g(field_type, schema)

Read an S1G field.

Parameters:

• field_type (FieldType) – type of the field

• schema (S1G) – parsed field schema

Return type:

S1G

Returns:

Parsed field data.

_read_field_usig(field_type, schema)

Read a U-SIG field.

Parameters:

• field_type (FieldType) – type of the field

• schema (USIG) – parsed field schema

Return type:

USIG

Returns:

Parsed field data.

_read_field_eht(field_type, schema)

Read an EHT field.

Parameters:

• field_type (FieldType) – type of the field

• schema (EHT) – parsed field schema

Return type:

EHT

Returns:

Parsed field data.

_make_field_unknown(field_type, entry)

Make the octets of a field that is written raw: an unknown one, or one of a type with no layout.

Parameters:

• field_type (FieldType) – type of the field

• entry (RadiotapField | Mapping[str, Any]) – field data, whose data is the octets

Return type:

Unknown

Returns:

Constructed field schema.

Raises:

ProtocolError – If data is not bytes.

_make_field_tsft(field_type, entry)

Make a TSFT field.

Parameters:

• field_type (FieldType) – type of the field

• entry (TSFT | Mapping[str, Any]) – field data, a data model or a mapping of its subfields

Return type:

TSFT

Returns:

Constructed field schema.

_make_field_flags(field_type, entry)

Make a Flags field.

Parameters:

• field_type (FieldType) – type of the field

• entry (Flags | Mapping[str, Any]) – field data, a data model or a mapping of its subfields

Return type:

Flags

Returns:

Constructed field schema.

_make_field_rate(field_type, entry)

Make a Rate field.

Parameters:

• field_type (FieldType) – type of the field

• entry (Rate | Mapping[str, Any]) – field data, a data model or a mapping of its subfields

Return type:

Rate

Returns:

Constructed field schema.

_make_field_channel(field_type, entry)

Make a Channel field.

Parameters:

• field_type (FieldType) – type of the field

• entry (Channel | Mapping[str, Any]) – field data, a data model or a mapping of its subfields

Return type:

Channel

Returns:

Constructed field schema.

_make_field_fhss(field_type, entry)

Make an FHSS field.

Parameters:

• field_type (FieldType) – type of the field

• entry (FHSS | Mapping[str, Any]) – field data, a data model or a mapping of its subfields

Return type:

FHSS

Returns:

Constructed field schema.

_make_field_antenna_signal(field_type, entry)

Make an Antenna signal field.

Parameters:

• field_type (FieldType) – type of the field

• entry (AntennaSignal | Mapping[str, Any]) – field data, a data model or a mapping of its subfields

Return type:

AntennaSignal

Returns:

Constructed field schema.

_make_field_antenna_noise(field_type, entry)

Make an Antenna noise field.

Parameters:

• field_type (FieldType) – type of the field

• entry (AntennaNoise | Mapping[str, Any]) – field data, a data model or a mapping of its subfields

Return type:

AntennaNoise

Returns:

Constructed field schema.

_make_field_lock_quality(field_type, entry)

Make a Lock quality field.

Parameters:

• field_type (FieldType) – type of the field

• entry (LockQuality | Mapping[str, Any]) – field data, a data model or a mapping of its subfields

Return type:

LockQuality

Returns:

Constructed field schema.

_make_field_tx_attenuation(field_type, entry)

Make a TX attenuation field.

Parameters:

• field_type (FieldType) – type of the field

• entry (TXAttenuation | Mapping[str, Any]) – field data, a data model or a mapping of its subfields

Return type:

TXAttenuation

Returns:

Constructed field schema.

_make_field_db_tx_attenuation(field_type, entry)

Make a dB TX attenuation field.

Parameters:

• field_type (FieldType) – type of the field

• entry (DBTXAttenuation | Mapping[str, Any]) – field data, a data model or a mapping of its subfields

Return type:

DBTXAttenuation

Returns:

Constructed field schema.

_make_field_dbm_tx_power(field_type, entry)

Make a dBm TX power field.

Parameters:

• field_type (FieldType) – type of the field

• entry (DBmTXPower | Mapping[str, Any]) – field data, a data model or a mapping of its subfields

Return type:

DBmTXPower

Returns:

Constructed field schema.

_make_field_antenna(field_type, entry)

Make an Antenna field.

Parameters:

• field_type (FieldType) – type of the field

• entry (Antenna | Mapping[str, Any]) – field data, a data model or a mapping of its subfields

Return type:

Antenna

Returns:

Constructed field schema.

_make_field_db_antenna_signal(field_type, entry)

Make a dB antenna signal field.

Parameters:

• field_type (FieldType) – type of the field

• entry (DBAntennaSignal | Mapping[str, Any]) – field data, a data model or a mapping of its subfields

Return type:

DBAntennaSignal

Returns:

Constructed field schema.

_make_field_db_antenna_noise(field_type, entry)

Make a dB antenna noise field.

Parameters:

• field_type (FieldType) – type of the field

• entry (DBAntennaNoise | Mapping[str, Any]) – field data, a data model or a mapping of its subfields

Return type:

DBAntennaNoise

Returns:

Constructed field schema.

_make_field_rx_flags(field_type, entry)

Make an RX flags field.

Parameters:

• field_type (FieldType) – type of the field

• entry (RXFlags | Mapping[str, Any]) – field data, a data model or a mapping of its subfields

Return type:

RXFlags

Returns:

Constructed field schema.

_make_field_tx_flags(field_type, entry)

Make a TX flags field.

Parameters:

• field_type (FieldType) – type of the field

• entry (TXFlags | Mapping[str, Any]) – field data, a data model or a mapping of its subfields

Return type:

TXFlags

Returns:

Constructed field schema.

_make_field_rts_retries(field_type, entry)

Make an RTS retries field.

Parameters:

• field_type (FieldType) – type of the field

• entry (RTSRetries | Mapping[str, Any]) – field data, a data model or a mapping of its subfields

Return type:

RTSRetries

Returns:

Constructed field schema.

_make_field_data_retries(field_type, entry)

Make a data retries field.

Parameters:

• field_type (FieldType) – type of the field

• entry (DataRetries | Mapping[str, Any]) – field data, a data model or a mapping of its subfields

Return type:

DataRetries

Returns:

Constructed field schema.

_make_field_mcs(field_type, entry)

Make an MCS field.

Parameters:

• field_type (FieldType) – type of the field

• entry (MCS | Mapping[str, Any]) – field data, a data model or a mapping of its subfields

Return type:

MCS

Returns:

Constructed field schema.

_make_field_ampdu_status(field_type, entry)

Make an A-MPDU status field.

Parameters:

• field_type (FieldType) – type of the field

• entry (AMPDUStatus | Mapping[str, Any]) – field data, a data model or a mapping of its subfields

Return type:

AMPDUStatus

Returns:

Constructed field schema.

_make_field_vht(field_type, entry)

Make a VHT field.

Parameters:

• field_type (FieldType) – type of the field

• entry (VHT | Mapping[str, Any]) – field data, a data model or a mapping of its subfields

Return type:

VHT

Returns:

Constructed field schema.

_make_field_timestamp(field_type, entry)

Make a timestamp field.

Parameters:

• field_type (FieldType) – type of the field

• entry (Timestamp | Mapping[str, Any]) – field data, a data model or a mapping of its subfields

Return type:

Timestamp

Returns:

Constructed field schema.

_make_field_he(field_type, entry)

Make an HE field.

Parameters:

• field_type (FieldType) – type of the field

• entry (HE | Mapping[str, Any]) – field data, a data model or a mapping of its subfields

Return type:

HE

Returns:

Constructed field schema.

_make_field_he_mu(field_type, entry)

Make an HE-MU field.

Parameters:

• field_type (FieldType) – type of the field

• entry (HEMU | Mapping[str, Any]) – field data, a data model or a mapping of its subfields

Return type:

HEMU

Returns:

Constructed field schema.

_make_field_he_mu_other_user(field_type, entry)

Make an HE-MU-other-user field.

Parameters:

• field_type (FieldType) – type of the field

• entry (HEMUOtherUser | Mapping[str, Any]) – field data, a data model or a mapping of its subfields

Return type:

HEMUOtherUser

Returns:

Constructed field schema.

_make_field_zero_length_psdu(field_type, entry)

Make a 0-length-PSDU field.

Parameters:

• field_type (FieldType) – type of the field

• entry (ZeroLengthPSDU | Mapping[str, Any]) – field data, a data model or a mapping of its subfields

Return type:

ZeroLengthPSDU

Returns:

Constructed field schema.

_make_field_lsig(field_type, entry)

Make an L-SIG field.

Parameters:

• field_type (FieldType) – type of the field

• entry (LSIG | Mapping[str, Any]) – field data, a data model or a mapping of its subfields

Return type:

LSIG

Returns:

Constructed field schema.

_make_field_s1g(field_type, entry)

Make an S1G field.

Parameters:

• field_type (FieldType) – type of the field

• entry (S1G | Mapping[str, Any]) – field data, a data model or a mapping of its subfields

Return type:

S1G

Returns:

Constructed field schema.

_make_field_usig(field_type, entry)

Make a U-SIG field.

Parameters:

• field_type (FieldType) – type of the field

• entry (USIG | Mapping[str, Any]) – field data, a data model or a mapping of its subfields

Return type:

USIG

Returns:

Constructed field schema.

_make_field_eht(field_type, entry)

Make an EHT field.

Parameters:

• field_type (FieldType) – type of the field

• entry (EHT | Mapping[str, Any]) – field data, a data model or a mapping of its subfields

Return type:

EHT

Returns:

Constructed field schema.

_get_payload()

Get the 802.11 MAC frame this header precedes.

The header schema’s payload starts right after the fixed 8-octet start, so it also holds the present-flags chain and the field-data region it selects; those belong to this header, and the frame starts self._mac_offset octets in, as read() records it. Both Protocol._import_next_layer and the Raw that beholder() falls back to on a refused frame read from here.

Return type:

bytes

Returns:

The 802.11 MAC frame, as bytes.

__proto__: DefaultDict[int | LinkType, ModuleDescriptor[ProtocolBase] | Type[ProtocolBase]]

Protocol index mapping for decoding next layer, keyed by the link type of the frame the header precedes; read() always looks up LinkType.IEEE802_11.

__proto_key__: ClassVar[tuple[Type[EnumRegistry], bool]]

What __proto__ is keyed by, declared as Link.__proto_key__ is.

__field__: DefaultDict[FieldType | int, str | tuple[Callable[[FieldType, RadiotapField], RadiotapField], Callable[[FieldType, RadiotapField | Mapping[str, Any]], RadiotapField]]]

Field type to method mapping, see _read_radiotap_fields() and _make_radiotap_fields(). A str value names the methods _read_field_${name} and _make_field_${name}, any other value is a (parser, constructor) pair; either works on the type’s schema in the RadiotapField registry. A type missing from either has no layout and is kept raw. Presence bits 28 to 30 and vendor namespace TLV items follow rules of their own, see the module docstring; a type from 32 on is reached as a TLV item only.

Header Schemas

class pcapkit.protocols.schema.link.radiotap.Radiotap(it_version=NO_VALUE, it_pad=NO_VALUE, it_len=NO_VALUE, it_present=NO_VALUE, payload=NO_VALUE, *, __packet__=None, **kwargs)

Bases: Schema

Header schema for an IEEE 802.11 radiotap header.

Only the fixed 8-octet start – it_version, it_pad, it_len and the first it_present word – is given its own field, all little-endian per radiotap.org. Everything that follows – any extended present-flags words, the optional-field region they select, and the 802.11 MAC frame behind it – is captured together as payload, since where one ends and the next begins is only known once the present-flags chain itself has been walked; see Radiotap.read. Each field in the region is a RadiotapField of its own.

it_version: int = <UInt8Field it_version>

Header revision.

it_pad: int = <UInt8Field it_pad>

Padding octet.

it_len: int = <UInt16Field it_len>

Total header length, including this fixed start.

it_present: int = <UInt32Field it_present>

First present-flags word.

payload: bytes = <PayloadField payload>

Everything after the fixed start – see the class docstring.

class pcapkit.protocols.schema.link.radiotap.RadiotapField(*args, **kwargs)

Bases: EnumSchema[FieldType]

Header schema for a radiotap field, little-endian on the wire.

A subclass registered with a field type is the layout of that type’s field, as its page on radiotap.org gives it: its subfields are the schema’s fields, its size their total, and its alignment __align__. A field a presence bit selects has a fixed size.

__align__: ClassVar[int] = 1

Alignment of the field, in octets counted from the start of the header.

class pcapkit.protocols.schema.link.radiotap.Unknown(data=NO_VALUE, *, __packet__=None, **kwargs)

Bases: RadiotapField

Header schema for an octet run a field type does not decode, kept whole.

data: bytes = <BytesField data>

The octets, to the end of the field-data region.

class pcapkit.protocols.schema.link.radiotap.TSFT(mactime=NO_VALUE, *, __packet__=None, **kwargs)

Bases: RadiotapField

Header schema for the TSFT field, bit 0.

mactime: int = <UInt64Field mactime>

Time Synchronization Function timer, in microseconds.

class pcapkit.protocols.schema.link.radiotap.Flags(flags=NO_VALUE, *, __packet__=None, **kwargs)

Bases: RadiotapField

Header schema for the Flags field, bit 1.

flags: Flags = <EnumField flags>

Properties of the frame.

class pcapkit.protocols.schema.link.radiotap.Rate(rate=NO_VALUE, *, __packet__=None, **kwargs)

Bases: RadiotapField

Header schema for the Rate field, bit 2.

rate: int = <UInt8Field rate>

TX/RX data rate, in 500 kbps.

class pcapkit.protocols.schema.link.radiotap.Channel(frequency=NO_VALUE, flags=NO_VALUE, *, __packet__=None, **kwargs)

Bases: RadiotapField

Header schema for the Channel field, bit 3.

frequency: int = <UInt16Field frequency>

TX/RX frequency, in MHz.

flags: ChannelFlags = <EnumField flags>

Channel flags.

class pcapkit.protocols.schema.link.radiotap.FHSS(hop_set=NO_VALUE, hop_pattern=NO_VALUE, *, __packet__=None, **kwargs)

Bases: RadiotapField

Header schema for the FHSS field, bit 4.

Its page names no alignment; the Linux kernel, Wireshark and radiotap-library align it to 2.

hop_set: int = <UInt8Field hop_set>

Hop set.

hop_pattern: int = <UInt8Field hop_pattern>

Hop pattern.

class pcapkit.protocols.schema.link.radiotap.AntennaSignal(signal=NO_VALUE, *, __packet__=None, **kwargs)

Bases: RadiotapField

Header schema for the Antenna signal field, bit 5.

signal: int = <Int8Field signal>

RF signal power at the antenna, in dBm.

class pcapkit.protocols.schema.link.radiotap.AntennaNoise(noise=NO_VALUE, *, __packet__=None, **kwargs)

Bases: RadiotapField

Header schema for the Antenna noise field, bit 6.

noise: int = <Int8Field noise>

RF noise power at the antenna, in dBm.

class pcapkit.protocols.schema.link.radiotap.LockQuality(quality=NO_VALUE, *, __packet__=None, **kwargs)

Bases: RadiotapField

Header schema for the Lock quality field, bit 7.

quality: int = <UInt16Field quality>

Quality of Barker code lock.

class pcapkit.protocols.schema.link.radiotap.TXAttenuation(attenuation=NO_VALUE, *, __packet__=None, **kwargs)

Bases: RadiotapField

Header schema for the TX attenuation field, bit 8.

attenuation: int = <UInt16Field attenuation>

Transmit power below the maximum, unitless.

class pcapkit.protocols.schema.link.radiotap.DBTXAttenuation(attenuation=NO_VALUE, *, __packet__=None, **kwargs)

Bases: RadiotapField

Header schema for the dB TX attenuation field, bit 9.

attenuation: int = <UInt16Field attenuation>

Transmit power below the maximum, in dB.

class pcapkit.protocols.schema.link.radiotap.DBmTXPower(power=NO_VALUE, *, __packet__=None, **kwargs)

Bases: RadiotapField

Header schema for the dBm TX power field, bit 10.

power: int = <Int8Field power>

Transmit power, in dBm.

class pcapkit.protocols.schema.link.radiotap.Antenna(antenna=NO_VALUE, *, __packet__=None, **kwargs)

Bases: RadiotapField

Header schema for the Antenna field, bit 11.

antenna: int = <UInt8Field antenna>

Antenna index.

class pcapkit.protocols.schema.link.radiotap.DBAntennaSignal(signal=NO_VALUE, *, __packet__=None, **kwargs)

Bases: RadiotapField

Header schema for the dB antenna signal field, bit 12.

signal: int = <UInt8Field signal>

RF signal power at the antenna, in dB from an arbitrary reference.

class pcapkit.protocols.schema.link.radiotap.DBAntennaNoise(noise=NO_VALUE, *, __packet__=None, **kwargs)

Bases: RadiotapField

Header schema for the dB antenna noise field, bit 13.

noise: int = <UInt8Field noise>

RF noise power at the antenna, in dB from an arbitrary reference.

class pcapkit.protocols.schema.link.radiotap.RXFlags(flags=NO_VALUE, *, __packet__=None, **kwargs)

Bases: RadiotapField

Header schema for the RX flags field, bit 14.

flags: RXFlags = <EnumField flags>

Properties of the received frame.

class pcapkit.protocols.schema.link.radiotap.TXFlags(flags=NO_VALUE, *, __packet__=None, **kwargs)

Bases: RadiotapField

Header schema for the TX flags field, bit 15.

flags: TXFlags = <EnumField flags>

Properties of the transmitted frame.

class pcapkit.protocols.schema.link.radiotap.RTSRetries(retries=NO_VALUE, *, __packet__=None, **kwargs)

Bases: RadiotapField

Header schema for the RTS retries field, bit 16, from radiotap.org’s unofficial fields.

retries: int = <UInt8Field retries>

RTS retries.

class pcapkit.protocols.schema.link.radiotap.DataRetries(retries=NO_VALUE, *, __packet__=None, **kwargs)

Bases: RadiotapField

Header schema for the data retries field, bit 17, from radiotap.org’s unofficial fields.

retries: int = <UInt8Field retries>

Data retries.

class pcapkit.protocols.schema.link.radiotap.MCS(known=NO_VALUE, flags=NO_VALUE, mcs=NO_VALUE, *, __packet__=None, **kwargs)

Bases: RadiotapField

Header schema for the MCS field, bit 19.

known: MCSKnown = <EnumField known>

Which of flags and mcs are known.

flags: dict[str, Any] = <BitmapField flags>

Bandwidth, guard interval, HT format, FEC type, STBC streams and the low bit of the extension spatial streams.

mcs: int = <UInt8Field mcs>

MCS rate index.

class pcapkit.protocols.schema.link.radiotap.AMPDUStatus(reference=NO_VALUE, flags=NO_VALUE, delimiter_crc=NO_VALUE, reserved=NO_VALUE, *, __packet__=None, **kwargs)

Bases: RadiotapField

Header schema for the A-MPDU status field, bit 20.

reference: int = <UInt32Field reference>

Reference number of the A-MPDU.

flags: AMPDUFlags = <EnumField flags>

Flags.

delimiter_crc: int = <UInt8Field delimiter_crc>

A-MPDU subframe delimiter CRC.

reserved: int = <UInt8Field reserved>

Reserved.

class pcapkit.protocols.schema.link.radiotap.VHT(known=NO_VALUE, flags=NO_VALUE, bandwidth=NO_VALUE, mcs_nss=NO_VALUE, coding=NO_VALUE, group_id=NO_VALUE, partial_aid=NO_VALUE, *, __packet__=None, **kwargs)

Bases: RadiotapField

Header schema for the VHT field, bit 21.

known: VHTKnown = <EnumField known>

Which of the subfields are known.

flags: VHTFlags = <EnumField flags>

Flags.

bandwidth: int = <UInt8Field bandwidth>

Bandwidth.

mcs_nss: list[int] = <ListField mcs_nss>

MCS and NSS of each of the four users.

coding: VHTCoding = <EnumField coding>

FEC coding of each user.

group_id: int = <UInt8Field group_id>

Group ID.

partial_aid: int = <UInt16Field partial_aid>

Partial AID.

class pcapkit.protocols.schema.link.radiotap.Timestamp(timestamp=NO_VALUE, accuracy=NO_VALUE, unit_position=NO_VALUE, flags=NO_VALUE, *, __packet__=None, **kwargs)

Bases: RadiotapField

Header schema for the timestamp field, bit 22.

timestamp: int = <UInt64Field timestamp>

Timestamp.

accuracy: int = <UInt16Field accuracy>

Accuracy, in nanoseconds.

unit_position: int = <UInt8Field unit_position>

Unit and sampling position.

flags: TimestampFlags = <EnumField flags>

Flags.

class pcapkit.protocols.schema.link.radiotap.HE(data1=NO_VALUE, data2=NO_VALUE, data3=NO_VALUE, data4=NO_VALUE, data5=NO_VALUE, data6=NO_VALUE, *, __packet__=None, **kwargs)

Bases: RadiotapField

Header schema for the HE field, bit 23.

data1: dict[str, Any] = <BitmapField data1>

PPDU format, and which other subfields are known.

data2: dict[str, Any] = <BitmapField data2>

RU allocation offset, primary or secondary 80 MHz, and which other subfields are known.

data3: int = <UInt16Field data3>

Third data word.

data4: int = <UInt16Field data4>

Fourth data word.

data5: int = <UInt16Field data5>

Fifth data word.

data6: int = <UInt16Field data6>

Sixth data word.

class pcapkit.protocols.schema.link.radiotap.HEMU(flags1=NO_VALUE, flags2=NO_VALUE, ru_channel1=NO_VALUE, ru_channel2=NO_VALUE, *, __packet__=None, **kwargs)

Bases: RadiotapField

Header schema for the HE-MU field, bit 24.

flags1: dict[str, Any] = <BitmapField flags1>

SIG-B MCS and DCM, the channel 1 center 26-tone RU, and which subfields are known.

flags2: dict[str, Any] = <BitmapField flags2>

Bandwidth, SIG-B compression, SIG-B symbols or MU-MIMO users, preamble puncturing, the channel 2 center 26-tone RU, and which are known.

ru_channel1: list[int] = <ListField ru_channel1>

RU allocation of channel 1.

ru_channel2: list[int] = <ListField ru_channel2>

RU allocation of channel 2.

class pcapkit.protocols.schema.link.radiotap.HEMUOtherUser(per_user_1=NO_VALUE, per_user_2=NO_VALUE, per_user_position=NO_VALUE, per_user_known=NO_VALUE, *, __packet__=None, **kwargs)

Bases: RadiotapField

Header schema for the HE-MU-other-user field, bit 25.

per_user_1: int = <UInt16Field per_user_1>

First per-user word.

per_user_2: int = <UInt16Field per_user_2>

Second per-user word.

per_user_position: int = <UInt8Field per_user_position>

Position of the user.

per_user_known: HEMUOtherUserKnown = <EnumField per_user_known>

Which of the per-user subfields are known.

class pcapkit.protocols.schema.link.radiotap.ZeroLengthPSDU(psdu_type=NO_VALUE, *, __packet__=None, **kwargs)

Bases: RadiotapField

Header schema for the 0-length-PSDU field, bit 26.

psdu_type: int = <UInt8Field psdu_type>

Why no PSDU was captured.

class pcapkit.protocols.schema.link.radiotap.LSIG(data1=NO_VALUE, data2=NO_VALUE, *, __packet__=None, **kwargs)

Bases: RadiotapField

Header schema for the L-SIG field, bit 27.

data1: LSIGData1 = <EnumField data1>

Which of the subfields of data2 are known.

data2: int = <UInt16Field data2>

Rate and length.

class pcapkit.protocols.schema.link.radiotap.VendorNamespace(oui=NO_VALUE, sub_namespace=NO_VALUE, skip_length=NO_VALUE, *, __packet__=None, **kwargs)

Bases: RadiotapField

Header schema for the Vendor Namespace field, bit 30.

The vendor data it gives the length of follows it, and is not a subfield of its own; nor is the schema registered, since a vendor namespace TLV is a VendorTLV instead.

oui: bytes = <BytesField oui>

OUI of the vendor.

sub_namespace: int = <UInt8Field sub_namespace>

Sub-namespace of the vendor’s.

skip_length: int = <UInt16Field skip_length>

Octets of vendor data that follow.

class pcapkit.protocols.schema.link.radiotap.S1G(known=NO_VALUE, data1=NO_VALUE, data2=NO_VALUE, *, __packet__=None, **kwargs)

Bases: RadiotapField

Header schema for the S1G field, type 32, which only a TLV carries.

known: S1GKnown = <EnumField known>

Which of the subfields are known.

data1: int = <UInt16Field data1>

First data word.

data2: int = <UInt16Field data2>

Second data word.

class pcapkit.protocols.schema.link.radiotap.USIG(common=NO_VALUE, value=NO_VALUE, mask=NO_VALUE, *, __packet__=None, **kwargs)

Bases: RadiotapField

Header schema for the U-SIG field, type 33, which only a TLV carries.

common: dict[str, Any] = <BitmapField common>

PHY version, bandwidth, UL/DL, BSS color and TXOP, and which are known.

value: int = <UInt32Field value>

Value of the U-SIG bits.

mask: int = <UInt32Field mask>

Which of value’s bits are known.

class pcapkit.protocols.schema.link.radiotap.EHT(known=NO_VALUE, data=NO_VALUE, user_info=NO_VALUE, *, __packet__=None, **kwargs)

Bases: RadiotapField

Header schema for the EHT field, type 34, which only a TLV carries.

known: EHTKnown = <EnumField known>

Which of the subfields are known.

data: list[int] = <ListField data>

The data words, nine of them.

user_info: list[int] = <ListField user_info>

One word per user, to the end of the field.

class pcapkit.protocols.schema.link.radiotap.TLV(type=NO_VALUE, length=NO_VALUE, *, __packet__=None, **kwargs)

Bases: RadiotapField

Header schema for the type and length opening a TLV item, bit 28.

The item’s data follows, then padding to its __align__, which the TLV list is aligned to as well. The schema is not registered, since a TLV item is no field of a type of its own.

type: FieldType = <EnumField type>

Type of the item, a field type.

length: int = <UInt16Field length>

Octets of the item’s data.

class pcapkit.protocols.schema.link.radiotap.VendorTLV(oui=NO_VALUE, subtype=NO_VALUE, presence_type=NO_VALUE, reserved=NO_VALUE, *, __packet__=None, **kwargs)

Bases: Schema

Header schema for the vendor header opening the data of a vendor namespace TLV item.

The vendor data follows, to the end of the item.

oui: bytes = <BytesField oui>

OUI of the vendor.

subtype: int = <UInt8Field subtype>

Sub-namespace of the vendor’s.

presence_type: int = <UInt16Field presence_type>

Vendor type of the data.

reserved: int = <UInt16Field reserved>

Reserved.

Data Models

class pcapkit.protocols.data.link.radiotap.Radiotap(it_version, it_pad, it_len, present, fields, decoded)

Bases: Protocol

Data model for an IEEE 802.11 radiotap header.

The fixed 8-octet start and the present-flags chain are decoded field by field; the optional-field region is kept whole as fields, which is what a rebuild writes, and decoded as decoded. See the module docstring’s Scope section on pcapkit.protocols.link.radiotap.

it_version: int

Header revision; 0 is the only version radiotap.org defines, and the only one this package decodes.

it_pad: int

Padding octet, kept for alignment; not interpreted.

it_len: int

Total length of the radiotap header – the fixed 8-octet start, every extended present-flags word, and the optional-field region they select – in octets; the 802.11 MAC frame starts here. Kept exactly as captured, even where it disagrees with present and fields.

present: tuple[int, ...]

Every present-flags word in the chain that was actually read, in order; index 0 is the mandatory first word (radiotap.org’s own it_present). Bit 31 of a word signals that another word follows; it is clear on the last word read, unless the capture ran out before a word it claimed would follow.

fields: bytes

The optional-field region present selects, kept whole.

decoded: OrderedMultiInfo[FieldType, RadiotapField]

The fields of fields, decoded in wire order, keyed by type: one per bit of present that selects data in the radiotap namespace or switches namespace. See Radiotap.read.

class pcapkit.protocols.data.link.radiotap.RadiotapField(*args, **kwargs)

Bases: Data

Data model for a radiotap field.

Each field’s subfields are named as its own page on radiotap.org names them, and each is the little-endian integer read off the wire. A bitmap radiotap.org defines bit by bit is a member of its flag registry under pcapkit.const.radiotap, which keeps the bits it does not name; any other bitmap stays the integer.

type: FieldType

The presence bit that selects the field, or its TLV type.

class pcapkit.protocols.data.link.radiotap.Unknown(type, data, reason)

Bases: RadiotapField

Data model for an octet run a field type does not decode.

It is the field of a presence bit no field is defined for, or of a field that does not fit in what the header holds, and it holds every octet from the end of the field before it to the end of the field-data region, since what follows cannot be located without knowing its size.

data: bytes

The octets, kept whole.

reason: str

The reason the walk stopped here, that the field type has no layout or that the field runs past the field-data region. Radiotap.make does not read it.

class pcapkit.protocols.data.link.radiotap.TSFT(type, mactime)

Bases: RadiotapField

Data model for the TSFT field, bit 0.

mactime: int

The MAC’s 64-bit Time Synchronization Function timer, in microseconds, when the first bit of the MPDU arrived.

class pcapkit.protocols.data.link.radiotap.Flags(type, flags)

Bases: RadiotapField

Data model for the Flags field, bit 1.

flags: Flags

Properties of the frame.

class pcapkit.protocols.data.link.radiotap.Rate(type, rate)

Bases: RadiotapField

Data model for the Rate field, bit 2.

rate: int

TX/RX data rate, in units of 500 kbps.

class pcapkit.protocols.data.link.radiotap.Channel(type, frequency, flags)

Bases: RadiotapField

Data model for the Channel field, bit 3.

frequency: int

TX/RX frequency, in MHz.

flags: ChannelFlags

Channel flags.

class pcapkit.protocols.data.link.radiotap.FHSS(type, hop_set, hop_pattern)

Bases: RadiotapField

Data model for the FHSS field, bit 4.

hop_set: int

Hop set of a frequency-hopping radio.

hop_pattern: int

Hop pattern of a frequency-hopping radio.

class pcapkit.protocols.data.link.radiotap.AntennaSignal(type, signal)

Bases: RadiotapField

Data model for the Antenna signal field, bit 5.

signal: int

RF signal power at the antenna, in dBm.

class pcapkit.protocols.data.link.radiotap.AntennaNoise(type, noise)

Bases: RadiotapField

Data model for the Antenna noise field, bit 6.

noise: int

RF noise power at the antenna, in dBm.

class pcapkit.protocols.data.link.radiotap.LockQuality(type, quality)

Bases: RadiotapField

Data model for the Lock quality field, bit 7.

quality: int

Quality of Barker code lock, unitless.

class pcapkit.protocols.data.link.radiotap.TXAttenuation(type, attenuation)

Bases: RadiotapField

Data model for the TX attenuation field, bit 8.

attenuation: int

Distance from the maximum transmit power, unitless; 0 is maximum power.

class pcapkit.protocols.data.link.radiotap.DBTXAttenuation(type, attenuation)

Bases: RadiotapField

Data model for the dB TX attenuation field, bit 9.

attenuation: int

Distance from the maximum transmit power, in dB; 0 is maximum power.

class pcapkit.protocols.data.link.radiotap.DBmTXPower(type, power)

Bases: RadiotapField

Data model for the dBm TX power field, bit 10.

power: int

Transmit power at the antenna port, in dBm.

class pcapkit.protocols.data.link.radiotap.Antenna(type, antenna)

Bases: RadiotapField

Data model for the Antenna field, bit 11.

antenna: int

Index of the RX/TX antenna, from 0.

class pcapkit.protocols.data.link.radiotap.DBAntennaSignal(type, signal)

Bases: RadiotapField

Data model for the dB antenna signal field, bit 12.

signal: int

RF signal power at the antenna, in dB from an arbitrary reference.

class pcapkit.protocols.data.link.radiotap.DBAntennaNoise(type, noise)

Bases: RadiotapField

Data model for the dB antenna noise field, bit 13.

noise: int

RF noise power at the antenna, in dB from an arbitrary reference.

class pcapkit.protocols.data.link.radiotap.RXFlags(type, flags)

Bases: RadiotapField

Data model for the RX flags field, bit 14.

flags: RXFlags

Properties of the received frame.

class pcapkit.protocols.data.link.radiotap.TXFlags(type, flags)

Bases: RadiotapField

Data model for the TX flags field, bit 15.

flags: TXFlags

Properties of the transmitted frame.

class pcapkit.protocols.data.link.radiotap.RTSRetries(type, retries)

Bases: RadiotapField

Data model for the RTS retries field, bit 16, which radiotap.org lists as unofficial.

retries: int

RTS retries the transmitted frame used.

class pcapkit.protocols.data.link.radiotap.DataRetries(type, retries)

Bases: RadiotapField

Data model for the data retries field, bit 17, which radiotap.org lists as unofficial.

retries: int

Data retries the transmitted frame used.

class pcapkit.protocols.data.link.radiotap.MCS(type, known, flags, mcs)

Bases: RadiotapField

Data model for the MCS field, bit 19.

known: MCSKnown

Which of flags and mcs are known.

flags: MCSFlags

Bandwidth, guard interval, HT format, FEC type, STBC and Ness.

mcs: int

MCS rate index, as in IEEE Std 802.11n-2009.

class pcapkit.protocols.data.link.radiotap.MCSFlags(bandwidth, guard_interval, ht_format, fec_type, stbc_streams, ness_bit0)

Bases: Data

Data model for the MCS field’s flags, each a value subfield.

Added in version 1.6.0.

bandwidth: int

Bandwidth, 0 for 20, 1 for 40, 2 for 20L and 3 for 20U.

guard_interval: int

Guard interval, 0 for long and 1 for short.

ht_format: int

HT format, 0 for mixed and 1 for greenfield.

fec_type: int

FEC type, 0 for BCC and 1 for LDPC.

stbc_streams: int

Number of STBC streams.

ness_bit0: int

Bit 0, the least significant, of the number of extension spatial streams.

class pcapkit.protocols.data.link.radiotap.AMPDUStatus(type, reference, flags, delimiter_crc, reserved)

Bases: RadiotapField

Data model for the A-MPDU status field, bit 20.

reference: int

Reference number, the same for every subframe of an A-MPDU.

flags: AMPDUFlags

A-MPDU flags.

delimiter_crc: int

Delimiter CRC value.

reserved: int

Reserved.

class pcapkit.protocols.data.link.radiotap.VHT(type, known, flags, bandwidth, mcs_nss, coding, group_id, partial_aid)

Bases: RadiotapField

Data model for the VHT field, bit 21.

known: VHTKnown

Which of the subfields below are known.

flags: VHTFlags

STBC, TXOP_PS_NOT_ALLOWED, guard interval, LDPC extra OFDM symbol and beamformed.

bandwidth: int

Bandwidth.

mcs_nss: tuple[int, int, int, int]

MCS and NSS of each of the four users.

coding: VHTCoding

Coding of each user.

group_id: int

Group ID.

partial_aid: int

Partial AID.

class pcapkit.protocols.data.link.radiotap.Timestamp(type, timestamp, accuracy, unit_position, flags)

Bases: RadiotapField

Data model for the timestamp field, bit 22.

timestamp: int

The timestamp, in the unit unit_position names.

accuracy: int

Expected accuracy of timestamp, in the same unit.

unit_position: int

Unit (bits 0-3) and sampling position (bits 4-7).

flags: TimestampFlags

Timestamp flags.

class pcapkit.protocols.data.link.radiotap.HE(type, data1, data2, data3, data4, data5, data6)

Bases: RadiotapField

Data model for the HE field, bit 23, mostly the common part of HE-SIG-A.

data1: HEData1

PPDU format and which of the subfields are known.

data2: HEData2

RU allocation offset, the 80 MHz channel, and which subfields are known.

data3: int

BSS color, beam change, UL/DL, MCS, DCM, coding, LDPC and STBC.

data4: int

Spatial reuse, or STA-ID in an HE MU PPDU.

data5: int

Bandwidth, guard interval, LTF symbol size, TxBF and PE disambiguity.

data6: int

NSTS, Doppler and TXOP.

class pcapkit.protocols.data.link.radiotap.HEData1(ppdu_format, known)

Bases: Data

Data model for the HE field’s data1, a value subfield and known bits.

Added in version 1.6.0.

ppdu_format: int

HE PPDU format, 0 for HE_SU, 1 for HE_EXT_SU, 2 for HE_MU and 3 for HE_TRIG.

known: HEData1Known

Which of the other subfields are known.

class pcapkit.protocols.data.link.radiotap.HEData2(ru_offset, pri_sec_80mhz, known)

Bases: Data

Data model for the HE field’s data2, value subfields and known bits.

Added in version 1.6.0.

ru_offset: int

RU allocation offset, within the 80 MHz channel.

pri_sec_80mhz: int

The 80 MHz channel, 0 for the primary and 1 for the secondary.

known: HEData2Known

Which of the other subfields are known.

class pcapkit.protocols.data.link.radiotap.HEMU(type, flags1, flags2, ru_channel1, ru_channel2)

Bases: RadiotapField

Data model for the HE-MU field, bit 24, from HE-SIG-A and HE-SIG-B.

flags1: HEMUFlags1

SIG-B MCS and DCM, the channel 1 center 26-tone RU, and which subfields are known.

flags2: HEMUFlags2

Bandwidth, SIG-B compression, SIG-B symbols or MU-MIMO users, preamble puncturing and the channel 2 center 26-tone RU.

ru_channel1: tuple[int, int, int, int]

RU_channel1, one octet per RU.

ru_channel2: tuple[int, int, int, int]

RU_channel2, one octet per RU.

class pcapkit.protocols.data.link.radiotap.HEMUFlags1(sig_b_mcs, sig_b_dcm, ch1_center_26_tone_ru, known)

Bases: Data

Data model for the HE-MU field’s flags1, value subfields and known bits.

Added in version 1.6.0.

sig_b_mcs: int

SIG-B MCS, from HE-SIG-A.

sig_b_dcm: int

SIG-B DCM, from HE-SIG-A.

ch1_center_26_tone_ru: int

Channel 1 center 26-tone RU value.

known: HEMUFlags1Known

Which of the subfields of this word and of flags2 are known.

class pcapkit.protocols.data.link.radiotap.HEMUFlags2(bandwidth, sig_b_compression, sig_b_symbols_users, preamble_puncturing, ch2_center_26_tone_ru, known)

Bases: Data

Data model for the HE-MU field’s flags2, value subfields and known bits.

Added in version 1.6.0.

bandwidth: int

Bandwidth from the Bandwidth field of HE-SIG-A, 0 for 20 MHz up to 3 for 160 or 80+80 MHz.

sig_b_compression: int

SIG-B compression, from HE-SIG-A.

sig_b_symbols_users: int

Number of HE-SIG-B symbols or MU-MIMO users, less one, from HE-SIG-A.

preamble_puncturing: int

Preamble puncturing, from the Bandwidth field of HE-SIG-A.

ch2_center_26_tone_ru: int

Channel 2 center 26-tone RU value.

known: HEMUFlags2Known

Which of the bandwidth and preamble puncturing are known.

class pcapkit.protocols.data.link.radiotap.HEMUOtherUser(type, per_user_1, per_user_2, per_user_position, per_user_known)

Bases: RadiotapField

Data model for the HE-MU-other-user field, bit 25, a SIG-B user field.

per_user_1: int

B0-B14 of the HE-SIG-B user field.

per_user_2: int

B15-B20 of the HE-SIG-B user field.

per_user_position: int

Position of the user field, from 0.

per_user_known: HEMUOtherUserKnown

Which of the subfields are known.

class pcapkit.protocols.data.link.radiotap.ZeroLengthPSDU(type, psdu_type)

Bases: RadiotapField

Data model for the 0-length-PSDU field, bit 26.

psdu_type: int

Type of the PPDU, the field radiotap.org names type.

class pcapkit.protocols.data.link.radiotap.LSIG(type, data1, data2)

Bases: RadiotapField

Data model for the L-SIG field, bit 27.

data1: LSIGData1

Which of the subfields in data2 are known.

data2: int

Rate (bits 0-3) and length (bits 4-15).

class pcapkit.protocols.data.link.radiotap.TLVFields(type, tlvs)

Bases: RadiotapField

Data model for the TLV fields in radiotap, bit 28.

The items fill the rest of the field-data region, each padded to a multiple of 4 octets.

tlvs: tuple[TLV, ...]

The items, in order.

class pcapkit.protocols.data.link.radiotap.RadiotapNamespace(type)

Bases: RadiotapField

Data model for the Radiotap Namespace field, bit 29 of a presence word.

It has no contents. The presence word after the one carrying it starts the radiotap namespace afresh, from bit 0.

class pcapkit.protocols.data.link.radiotap.VendorNamespace(type, oui, sub_namespace, skip_length, data)

Bases: RadiotapField

Data model for the Vendor Namespace field, bit 30 of a presence word.

The presence words after the one carrying it, up to the next namespace field, select fields of the vendor namespace, and the data of every one of them is in data, kept whole.

oui: bytes

The vendor’s IEEE 802 Organizationally Unique Identifier, 3 octets.

sub_namespace: int

Vendor-specific namespace selector.

skip_length: int

Octets of data, as the header gives it.

data: bytes

The vendor namespace’s data, kept whole.

class pcapkit.protocols.data.link.radiotap.S1G(type, known, data1, data2)

Bases: RadiotapField

Data model for the S1G field, TLV type 32.

known: S1GKnown

Which of the subfields are known.

data1: int

PPDU format, response indication, guard interval, NSS, bandwidth and MCS.

data2: int

Color, uplink indication and RSSI.

class pcapkit.protocols.data.link.radiotap.USIG(type, common, value, mask)

Bases: RadiotapField

Data model for the U-SIG field, TLV type 33.

common: USIGCommon

The common subfields, and which are known.

value: int

Version-dependent subfields.

mask: int

Which bits of value are known.

class pcapkit.protocols.data.link.radiotap.USIGCommon(phy_version, bandwidth, ul_dl, bss_color, txop, known)

Bases: Data

Data model for the U-SIG field’s common, value subfields and known bits.

Added in version 1.6.0.

phy_version: int

PHY version identifier.

bandwidth: int

Bandwidth, 0 for 20 MHz up to 3 for 160 MHz, and 4 and 5 for the two 320 MHz channelizations.

ul_dl: int

UL/DL.

bss_color: int

BSS color.

txop: int

TXOP.

known: USIGCommonKnown

Which of the subfields are known, and whether the U-SIG CRC failed and its validate bits were checked and found right.

class pcapkit.protocols.data.link.radiotap.EHT(type, known, data, user_info)

Bases: RadiotapField

Data model for the EHT field, TLV type 34.

known: EHTKnown

Which of the subfields are known.

data: tuple[int, ...]

The nine data words.

user_info: tuple[int, ...]

One word per user, as many as the TLV holds.

class pcapkit.protocols.data.link.radiotap.TLV(type, length, data)

Bases: Data

Data model for one item of the TLV fields in radiotap.

type: FieldType

Type, from the same allocation as the presence bits.

length: int

Length of data, in octets, less the padding after it.

data: RadiotapField | VendorTLV | bytes

The data, decoded where the type defines a layout length does not run past; the raw octets otherwise. Data short of the layout is decoded with the octets it lacks as zeros, and records the cut as __short_read__.

class pcapkit.protocols.data.link.radiotap.VendorTLV(oui, subtype, presence_type, reserved, data)

Bases: Data

Data model for the data of a vendor namespace TLV, type 30.

oui: bytes

The vendor’s IEEE 802 Organizationally Unique Identifier, 3 octets.

subtype: int

Vendor-specific subtype.

presence_type: int

Index of the presence bit the vendor data stands for.

reserved: int

Reserved, padding the vendor data to a 4-octet boundary.

data: bytes

The vendor data, kept whole.

Footnotes

[*]

<https://www.radiotap.org/>, its field pages and its radiotap-library; the Linux kernel’s include/net/ieee80211_radiotap.h and net/wireless/radiotap.c; and Wireshark’s packet-ieee80211-radiotap.c and packet-ieee80211-radiotap-iter.c.