2

In the packet captured below, captured by wireshark

enter image description here

does the SSI Signal in dBm represents the power at which the sniffing network adapter (say USB network adapter wlan1 on Raspberry Pi3) received the packet or it represents the power at which a nearby Wi-Fi AP (access point) received this packet? (Sorry if this question is too easy for you guys).

1 Answer 1

4

A similar point has been answered on Wireshark's own SO/SE in How to interpret signal strength. Yet we can add some more details here. And add some up to date links since the ones on that answer died.

The SSI Signal is radiotap's antena signal (and the SSI noise is the antenna noise) and we see in there:

RF signal power at the antenna. This field contains a single signed 8-bit value, which indicates the RF signal power at the antenna, in decibels difference from 1mW.

*(emphasis mine)

Borrowing from the answer on wireshark's SO we have:

10((dBm-30)/10) Watts

So, yeah, that pretty much is signal power. But note that that is:

  1. What your card is telling you, radiotap is an encapsulation, not something that actually went through the air. Therefore:

    the sniffing network adapter received the packet or it represents the power at which a nearby AP (access point) received this packet?

    It is the sniffing adapter/card/antenna.

  2. Not the strength of the signal for the packet it is the strength of the signal at the time that the packet was received. Now, as we saw in the radiotap quote above, it is the power at the antenna. But note that there is also noise there (SSI noise). I'm not particularly confident that:

    SSI Signal - SSI Noise = Actual power that the *packet* was received
    

    This is because you have Signal to Noise Ratio, and some of the noise could have been interpreted as part of the signal. SNR is beyond me though.

In summary, radiotap is the encapsulation of the state of your network card and antenna at the time that the packet was received. Whether that can be used as an estimate of AP signal strength is debatable. Since the signal strength is the signal of the network that the card is retrieving packets from and the rest is (more-or-less) noise then you can use that as an estimate.

In laboratory conditions I'd argue that the signal strength presented in the radiotap is a good enough estimate of signal AP strength discounted the distance from the AP. Yet, in the real world, e.g. in an urban area with a lot of APs and interference, the radiotap signal strength is neigh useless to tell you anything about an AP.


Extra

Also note that the radiotap encapsulation is part of IEEE 802.11 and is defacto standard for captured wireless packets. Calling it a header is an oversimplification. There is a header that defines several fields that may be present or not and then there is a list of fields that a certain card may or may not provide (but should tell you which ones are provided through the header). This can be analogous to TCP and TCP options.

For example, in the Linux kernel code you can find the definition of the header in include/net/ieee80211_radiotap.h. And then the structure that is built after the header in net/wireless/radiotap.c.

Some useful reading:

17
  • 2
    It is not included when the packet is sent, only after the packet is captured.
    – J.A.K.
    Feb 24, 2017 at 8:35
  • 1
    @haccks - What J.A.K. said. radiotap is an encapsulation of the state of your hardware, not part of the packet that was sent. I've added some clarification about whether is could be used to measure an AP, and I'd argue that it could but only in good conditions.
    – grochmal
    Feb 25, 2017 at 16:35
  • 1
    @J.A.K.; Yes. Exactly.
    – haccks
    Feb 25, 2017 at 19:17
  • 1
    @haccks - You're absolutely correct. What you will see there is the average power seen by the antenna at S. But, I believe, that you will also notice that there is a noticeable average difference in SSI signal between packets originating from A and from M. Power is dependent on amplitude and frequency, the frequency cannot change in a WiFi network so the bits are encoded as raising and diminishing amplitude (as far as i know). A and M may be using different max and min amplitudes. To find an RF origin with confidence you need to triangulate (or know all parameters).
    – grochmal
    Feb 26, 2017 at 17:45
  • 1
    Some other useful links: What are RadioTap Headers? and Physical layer info in wireless packet captures.
    – haccks
    Feb 26, 2017 at 20:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .