limit radiotap header size

limit radiotap header size

[freeman]

Hi

Linux latest kernel (3.16) doc says there are only 13 argument options now.
Is it still true?

If we are concerned about the size of radiotap header and want to limit the
set of info we pass to the sniffer, can we arbitrarily remove any arguments
from the bitmap? I know it is probably designed so, just want to double check :)

Thanks
Freeman

Re: limit radiotap header size

[Johannes Berg]

On Mon, 2014-09-15 at 20:10 +0000, freeman wrote:

> Linux latest kernel (3.16) doc says there are only 13 argument options now.
> Is it still true?

Where does it say that? I don't think there's any size limit on the
radiotap header since multiple things could show up multiple times etc.
and with the vendor namespace you could carry all kinds of other things.

> If we are concerned about the size of radiotap header and want to limit the
> set of info we pass to the sniffer, can we arbitrarily remove any arguments
> from the bitmap? I know it is probably designed so, just want to double check :)

Not really, no, you'd have to adjust the rest of the header as well,
basically parse and recreate it. Why would you want to anyway though?

johannes

Re: limit radiotap header size

[freeman]

Johannes Berg <johannes@...> writes:

> 
> On Mon, 2014-09-15 at 20:10 +0000, freeman wrote:
> 
> > Linux latest kernel (3.16) doc says there are only 13 argument options now.
> > Is it still true?
> 
> Where does it say that? I don't think there's any size limit on the
> radiotap header since multiple things could show up multiple times etc.
> and with the vendor namespace you could carry all kinds of other things.
> 
> > If we are concerned about the size of radiotap header and want to limit the
> > set of info we pass to the sniffer, can we arbitrarily remove any arguments
> > from the bitmap? I know it is probably designed so, just want to double
check :)
> 
> Not really, no, you'd have to adjust the rest of the header as well,
> basically parse and recreate it. Why would you want to anyway though?
> 
> johannes
> 
> 

Johannes

Thanks for the help.
It seems this kernel doc needs some update
http://lxr.free-electrons.com/source/Documentation/networking/radiotap-headers.txt

I think I was not clear in last email. If we have a tiny firmware to
generate the radiotap header for received packets, and we have limited RAM,
it might look attractive to only create a trimmed version radiotap header to
the sniffer application. 

Given the design of the bitmap in the fixed header, I guess it allows us to
only include a subset of all arguments, although it is always better to have
more info sent up. So in memory constrained systems, how much freedom we
have in creating radiotap headers?

My dream is that a user application can send a 32bit bitmap to the device
driver as a bitmask and the device only sends up those arguments enabled by
the mask.

Thanks
Freeman
 

Re: limit radiotap header size

[Johannes Berg]

On Tue, 2014-09-16 at 17:01 +0000, freeman wrote:

> Thanks for the help.
> It seems this kernel doc needs some update
> http://lxr.free-electrons.com/source/Documentation/networking/radiotap-headers.txt

That should probably just point to www.radiotap.org :)

> I think I was not clear in last email. If we have a tiny firmware to
> generate the radiotap header for received packets, and we have limited RAM,
> it might look attractive to only create a trimmed version radiotap header to
> the sniffer application. 
> 
> Given the design of the bitmap in the fixed header, I guess it allows us to
> only include a subset of all arguments, although it is always better to have
> more info sent up. So in memory constrained systems, how much freedom we
> have in creating radiotap headers?

You can chose to include or not include any information that you want.
The minimal radiotap header has a zero bitmap and no information at all
- but it's also useless. The more data you include, the more useful it
becomes.

> My dream is that a user application can send a 32bit bitmap to the device
> driver as a bitmask and the device only sends up those arguments enabled by
> the mask.

There's no API to send such down. If you invent API to send such down,
then you can of course build the header limited.

However, many times the capturing and analysis are done as two separate
steps, with the analysis being after the fact on a different system
etc., so I'm not sure how useful that would be. For my purposes I'd try
to always enable the maximum amount of information...

johannes