title: Parsing WiFi Packets (libpcap)
body: <p>I've been working on a way to have an OpenWRT router log WiFi probe requests to a MySQL db (it stores MAC address and RSSI info for each probe request packet along with other, router-specific data).</p>
  
  <p>After researching libpcap quite a bit, I've been able to cobble together a basic little program that simply sniffs packets on a monitor interface (mon0) using a filter expression ('wlan subtype probe-req') and then prints out the raw packets in hex. With the info that's available online on libpcap this part was fairly straightforward.</p>
  
  <p>Now here's where I'm stuck: <strong>How do I parse the WiFi packet to retrieve the info I'm looking for (RSSI and source MAC address)?</strong></p>
  
  <p>To be clear, I'm not asking for the code to do it (although I won't complain if you'd like to supply some :D). I'm just looking for some sort of guide for understanding which byte is which - a WiFi packet road map, if you will.</p>
  
  <p>There are a few good tutorials out there for parsing packets that come in over ethernet, but I haven't been able to find anything to help with parsing headers spcifically related to WiFi. I assume it will be a pretty simple process - just grabbing the relevant bytes for RSSI and source MAC - but again, I haven't been able to find any documentation on which byte is which.</p>
  
  <p>I know this has been done before but I'll be honest: I am completely lost when looking through the source code for tcpdump.</p>
  
  <p>So, does anyone know of a good resource for how to parse WiFi packets?</p>
  
  <p>Cheers</p>
  
  <p><strong>EDIT: More Specific Answer</strong></p>
  
  <p>RSSI is found in the RadioTap header (well, on Linux it is). Pulling the RSSI out of the packet is fairly straightforward using <a href="http://airscan.googlecode.com/svn-history/r2/trunk/radiotap-parser.c">radiotap-parser.c</a> along with the files it depends on (found in the same directory as the file I linked to). <em>If anyone is having trouble with using the radiotap-parser.c functions feel free to get in touch.</em></p>
  
  <p>Pulling out the source MAC address is made pretty easy by the radiotap functions because the radiotap header struct contains the length of the radiotap header (<code>it_len</code>), which is variable. Since I am parsing only probe requests, which have a fixed length (check out page 17 <a href="http://www.studioreti.it/slide/802-11-Frame_E_C.pdf">here</a>) it's just a matter of making a pointer that points to <code>packet + it_len + 10</code> (the source MAC address starts 10 bytes after the beginning of the MAC frame, which begins where the radiotap header ends). The 6 bytes that start at that pointer are <code>addr2</code> in the 802.11 frame (again, see page 17 <a href="http://www.studioreti.it/slide/802-11-Frame_E_C.pdf">here</a>).</p>