Re: capturing on both interfaces simultaneously

[Guy Harris <guy () alum mit edu>]

On Dec 12, 2011, at 12:31 AM, abhinav narain wrote:

> I see this usage by top command.
> VSZ reports 9304 Bytes.I think this must be virtual address space.

9394 *bytes*?  That's 15% of about 62KB; if that's 15% of your RAM, you're probably running on a machine with 64K, 
which I doubt.

Did you mean 9394KB?  top, at least on my machine (running Mac OS X), reports various memory sizes with B/K/M/G 
suffixes.

VSZ might give the size of the address space of your program; if your program is using shared libraries, that means 
it'll include the entire sizes of the code of the shared libraries, and if it's linked with the libc shared library, 
that could be a significant amount of virtual memory.  However, those pages are shared with other processes on the 
system, and not all of them are necessarily in physical memory, so that won't show how much *RAM* is being used.

> Ok. The point is I can know only the fact that an AP is a supporting n or
> not, at maximum ?

No, you can look at the HT Capabilities information element and find out other capabilities, such as whether Short GI 
is supported for 20 MHz and whether it's supported for 40 MHz.

> I am looking for alternative seeing into management frame and finding HT
> Capability...

*That's* what you need to parse if you're curious whether the AP supports 802.11n.

> TCPdump code reads the radiotap header and classifies the channel
> information using the radiotap header into the following :
> fhss A,G (half/full duplex) , B,T , HT40+,HT40-
> I am listening only for beacons in then network. Hence I notice I never see
> anything apart from A, G. When is HT40+,40- transmitted in radiotap header
> ? in data frames ?

Yes.  You won't see HT beacons; I'm surprised you're even seeing G beacons, as B-only stations won't be able to see 
them.

> Will I ever see HT40+,40- in case of beacons.

Probably not.

> Does this field in radiotap header (if it occurs) mean the interface beacon
> came from was having the above (equivilantly n ) support ?

No.  This field indicates how the particular frame was transmitted; it does not mean that the transmitting device 
cannot transmit in any other format.

> So, do I need to look at any other type of frames than beacons... Or just
> once AP support

If you're trying to find out the capabilities of an AP, its beacons should be sufficient if it's transmitting them.

> Ok. So, there is nothing as a N beacon..
> Only advertisements at 1,6 rate and then actual data at N speed.

Right.  The beacons will generally be transmitted at low speed, so even older stations can see them.

-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.