Skip to content

802.11 radiotap dissector for IEEE80211_RADIOTAP on LINUX_SLL/SLL2 #2502

Closed

Description

@JarryShaw

Summary

Part of #2460. LinuxSLL/LinuxSLL2 fall back to Raw for the
IEEE80211_RADIOTAP arphrd_type (803), whose protocol_type field isn't
an EtherType (see _ARPHRD_NOT_ETHERTYPE in
pcapkit/protocols/link/linux_sll.py). The header is preserved, nothing
crashes, but nothing is dissected either.

Scope

The widest of the five follow-ups in #2460: no 802.11 dissector of any kind
exists in this codebase, and radiotap is a prefix in front of the raw
802.11 MAC frame, not a replacement for it -- so this is really two new
protocols stacked, not one:

  1. the radiotap header itself -- a variable-length, vendor-extensible
    prefix: a fixed 8-octet start (version, pad, length, present-flags
    bitmask) followed by a chain of further present-flags words (bit 31 of
    each signals "more follow") and then the fields the bitmask selects, each
    with its own alignment rule. No fixed length; the header's own length
    field is what bounds it.
  2. the 802.11 MAC frame behind it -- frame control, duration/ID,
    address fields (2-4 of them depending on the ToDS/FromDS bits), sequence
    control, optional QoS/HT control, then the body (itself dispatching
    further by frame type/subtype: management, control, data).

Authoritative sources: the radiotap project's own field-by-field
specification (https://www.radiotap.org/) for (1), and IEEE 802.11
(the current base standard) §9 (MAC frame formats) for (2).

Given the scope, this likely wants its own further split once picked up
(radiotap header alone, with the 802.11 body kept Raw, as a first slice --
mirroring how #2460 broke its own five candidates apart). Not implemented
here -- tracked as its own issue per #2460's scoping.

Activity

  1. added
    featPull requests that add a new capability (feat: subject prefix)
    pendingAccepted and unstarted - nobody is on it and nothing blocks it
    on Oct 31, 2026
  2. moved this to Pending in PyPCAPKiton Oct 31, 2026
  3. added
    wipWork in flight - a covering PR is open or an agent is actively on it
    and removed
    pendingAccepted and unstarted - nobody is on it and nothing blocks it
    on Oct 31, 2026
  4. moved this from Pending to WIP in PyPCAPKiton Oct 31, 2026
  5. removed
    wipWork in flight - a covering PR is open or an agent is actively on it
    on Nov 1, 2026
  6. JarryShaw commented on Nov 1, 2026

    @JarryShaw
    OwnerAuthor

    Closing: #2509 delivered the slice this issue scoped first. Radiotap is dispatched from LinuxSLL for ARPHRD_IEEE80211_RADIOTAP. It decodes the fixed header and the present-flags chain, keeps the selected fields raw, and leaves the 802.11 frame Raw. The remaining scope is split into #2575 (802.11 MAC header, in progress) and #2576 (radiotap optional fields, blocked on #2575).

  7. added this to the PyPCAPKit v1.6 milestone on Nov 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    featPull requests that add a new capability (feat: subject prefix)

    Projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions