From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-qc0-x229.google.com (mail-qc0-x229.google.com [IPv6:2607:f8b0:400d:c01::229]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by huchra.bufferbloat.net (Postfix) with ESMTPS id B8F2F21F41A; Fri, 27 Mar 2015 11:13:21 -0700 (PDT) Received: by qcay5 with SMTP id y5so23553194qca.1; Fri, 27 Mar 2015 11:13:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; bh=LWGeqSuPeUbT0AazMeMvB0drMijfZdNY6g0tU20hwF8=; b=YDEf9nHBkEDv6CNQHdc/FHNDVc8vNvWuMcSyU/9HK645Dc4qGPkUBZe4QIf833Y4xj N7UnrIL6lF1Icv4sl33L0u451Y+9r+Y+fhtR9J4znVfAVEtuzNhJy12GVPahNtRuu0nm DEfrWW+baNeSPxIo7f9qb0QHQmXw0cC/YP1eHo/IZBX2/zKEbXdvI/s+hvdL8QbIvarB ftmIWSVzTBuxa/m7dT+GMSBgGti6EI6wS47aNE0S27SJlef2vZez6x0wvEXJHoX0VmvB ncUDjlpAhs5avY3IdPtrylJmiioeJGrIf1GJbE7BPbtHbMKLPQcZZKxwEhuUUy1IR45E 8GUw== X-Received: by 10.140.236.73 with SMTP id h70mr25956750qhc.41.1427480000489; Fri, 27 Mar 2015 11:13:20 -0700 (PDT) Received: from [192.168.1.219] (207-180-163-171.ma.subnet.cable.rcn.com. [207.180.163.171]) by mx.google.com with ESMTPSA id 21sm1946569qkp.39.2015.03.27.11.13.18 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 27 Mar 2015 11:13:19 -0700 (PDT) Message-ID: <55159DBD.3060702@gmail.com> Date: Fri, 27 Mar 2015 14:13:17 -0400 From: Richard Smith User-Agent: Mozilla/5.0 (X11; Linux i686; rv:31.0) Gecko/20100101 Thunderbird/31.4.0 MIME-Version: 1.0 To: Aaron Wood References: <55147C8A.4030804@candelatech.com> <55157250.6030208@gmail.com> In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Cc: bloat , codel , cerowrt-devel Subject: Re: [Cerowrt-devel] [Bloat] capturing packets and applying qdiscs X-BeenThere: cerowrt-devel@lists.bufferbloat.net X-Mailman-Version: 2.1.13 Precedence: list List-Id: Development issues regarding the cerowrt test router project List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 27 Mar 2015 18:13:50 -0000 On 03/27/2015 01:21 PM, Aaron Wood wrote: > Using the following filter in Wireshark should get you all that 6Mbps > traffic: > > radiotap.datarate == 6 Thanks. I'd not discovered that yet although I have so much of it that finding 6mbit packets is not much of a problem. > Then it's pretty easy to dig into what those are (by wifi frame-type, at > least). At my network, that's mostly broadcast traffic (AP beacons and > whatnot), as the corporate wifi has been set to use that rate as the > broadcast rate. Yeah. Beacons are supposed to be that low but that's only every 100ms. On my network its there are loads of data packets that are sent at 6mbit. > without capturing the WPA exchange, the contents of the data frames > can't be seen, of course. And this is where I seem to stall out. Even when I capture the full WPA exchange I only have limited success at getting wireshark to decode all my traffic. I have more success with using airdecap-ng decoding and then feeding that to wireshark but there are still times when it can't decode things and I can't see why. The full WPA exchange is clearly visible in the packet capture. -- Richard A. Smith