Re: Would it be useful to have preferences for radiotap to allow handling of captures with conflicting presence flags?

On Thu, Dec 14, 2017 at 3:24 PM, Guy Harris <guy-FrUbXkNCsVf2fBVCVOL8/[email protected]> wrote:
> On Dec 14, 2017, at 1:06 PM, Richard Sharpe <[email protected]> wrote:
>
>> I notice on this page
>>
>>  http://www.radiotap.org/fields/suggested
>>
>> it mentions that there are some conflicting usages of flag bits for radiotap.
>>
>> Currently, Wireshark knows about bit 14 in the presence flags, but
>> hard-codes it for rx-Flags.
>
> No, it has a preference for that, defaulting to rx-flags.  Tcpdump has no preference for it, hardwiring it to rx-flags.

Ahhh, I see you are correct. I looked for the radiotap protocol at
first and didn't see it. After you responded I looked in the code and
then discovered it was called 802.11 Radiotap. That's possibly a bit
onerous for users but that is a separate issue.

>> It also doesn't know about tx-Flags (or
>> hardware-queue).
>>
>> Would it be useful to allow the user to specify they want to be able
>> to switch between usages or are we trying to stamp out such
>> conflicting uses?
>
> The conflicts are historical; I think the intent for radiotap is that further conflicts be at least *very strongly* discouraged, if not simply forbidden.  I vote for "forbidden".  As the page you cite says:
>
>         Note that some fields currently have numbers assigned already, this is due to different OSes defining different bits unilaterally. *Such mistakes should not be repeated in the future.*
>
> (emphasis mine).
>
> The radiotap spec doesn't control what code that processes radiotap headers does; it neither requires nor forbids preferences.  I don't think it should require or forbid them as a way of dealing with existing conflicts, but it should (and does) say that no requirement for a preference should be introduced in the future.

Great. I will get to work adding some of the missing bits and maybe a
preference around the tx_flags and hardward_queue.

BTW, why is there what looks like 6-bytes of un-interpreted data
between the rx-flags and timestamp info?

I can send a capture if you would like to look.

-- 
Regards,
Richard Sharpe
(何以解憂？唯有杜康。--曹操)