1

After creating a wcap file with Wireless Diagnostics I used vim to inspect this file:

$ tcpdump -r 2017.98.14_17-33-49-EDT.wcap > output.txt

and then I removed all lines that had either of
(1) a MAC address.
(2) the "beacon" string.
(3) the "wep" string.

Here is a sample of what remained:

17:33:51.074520 4185535295us tsft -51dB signal -89dB noise antenna 0 5785 MHz 11a ht/40+ 65.0 Mb/s MCS 7 20 MHz (L) lon GI mixed BCC FEC [bit 20]
17:33:51.076525 4185537310us tsft short preamble 12.0 Mb/s 5785 MHz 11a -53dB signal -89dB noise antenna 0 BA RA:d4:b2:7a:39:f4:1e (oui Unknown)
17:33:51.289354 4185750140us tsft -53dB signal -87dB noise antenna 0 5785 MHz 11a ht/40+ 65.0 Mb/s MCS 7 20 MHz (L) lon GI mixed BCC FEC [bit 20]
17:33:51.611685 4186072156us tsft short preamble 6.0 Mb/s 5785 MHz 11a -79dB signal -87dB noise antenna 0 Action (a2:3a:de:12:fd:d5 (oui Unknown)): Vendor Act#0
....

  1. Doesn't each line in wcap represent a packet?
  2. If so, what type of packet is not a broadcast or does not have a MAC address?

Since I made the effort to inspect my LAN (for other reasons), I'm just curious. Not really a big deal of course.

1 Answer 1

2

Those remaining lines are very important metadata measured from the radio/baseband software to help troubleshooting issues with wireless that can crop up in cases of interference, lack of signal and to identify the hardware / media access layers of the network connection between the radio on your Mac and the radio on the access point.

In these specific lines, you have 802.11a (a less common protocol), and very good signal to noise ratios, the exact channel you are tuned in to and the basic data rate / encoding rate for the link between your Mac and the radio at the access point.

These data would be very helpful if you were seeing large numbers of errors or retransmits or didn’t know which base station you were connecting to.

2
  • yikes. My regular expression didn't quite remove all the MAC addresses!
    – rather
    Aug 15, 2017 at 1:27
  • But it left some good data filtered out from the noise, @rather
    – bmike
    Aug 15, 2017 at 1:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .