Wireless airtime analysis

This page is devoted to the analysis of the airtime consumption in XO networks. In other words, to getting answers to questions like: how much of the medium is consumed by management traffic, or beacons, or the path discovery mechanism.

To obtain this answers we do a little math and introduce a tool that will make this math easier to do.

Airtime and Modulation technique

The time necessary to transmit a given frame is function not only of the transmission rate; it is also affected by the modulation technique in use. An XO will transmit frames in two different mechanisms:

• For the rates 1, 2, 5.5 and 11 Mbps, frames will be transmitted in CCK
• For the rates 6, 9, 12, 18, 24, 36, 48 and 54 Mbps, frames will be transmitted in OFDM

Given:

• Frame size in bytes: S
• Datarate in Mbps: R
• Airtime in microseconds (us): T

For frames transmitted in CCK:

T = 192 + (S*8)/R

Note1: 192 is preamble duration (144 us) + PLPC header duration (48 us)
Note2: Supposing long preambles are being used in all transmissions.

For frames transmitted at more than 11 Mbps (OFDM):

T = 26 + (S*8)/R

Note: 26 is signal extension time (6us) + preamble (20us)

Airtime tool

This python tool was designed to take a capture file (tcpdump format) as input and calculate the airtime consumption of a given type of traffic (specified by a wireshark filter) for a consolidation interval:

Instructions

You need wireshark on the box (the script uses tshark to decode the file). If you want to decode mesh frames you will need the mesh patch. No other dependencies. Just make the script executable and fire it:

./airtime.py -f <pcap-file> -i <interval> -w <filter> -o <output_format> [--no-fcs]

Options:
 -h, --help            show this help message and exit
 -f PCAPFILE, --pcap-file=PCAPFILE
                       Capture dump
 -t TEXTFILE, --text-file=TEXTFILE
                       Capture already converted/filtered
 -i INTERVAL, --interval=INTERVAL
                       Consolidation interval in seconds
 -w FILTER, --filter=FILTER
                       Wireshark filter
 -o OUTPUT, --output-format=OUTPUT
                       Output Format [csv, lines]
 --no-fcs              don't check if frames have bad crc

Notes

• The input file (PCAPFILE) is a tcpdump capture file (captured by tcpdump, wireshark or any other compatible tool)
  • Radiotap header must be present (for the script needs the tx datarate)
  • If your capture does not provide Frame CheckSum (this is the case of the captures from XOs) you must provide the flag --no-fcs
  • By default only frames with good FCS will be computed
• The script generates a temporary file in the local directory named <caprute file>.tmp3
  • This file can be used instead of the original pcap file (using the -t option), if the filter is the same. This is meant to save processing time if you are to use the same set of data, changing only the consolidation interval.
  • The .tmp3 file can be safely removed
• The default output format will dump a line for each consolidation timeslot with the percentage of airtime consumed.
  • You can use '-o csv' to get a comma separated file that can be easily imported by a spreadsheet program
• Filters should be quoted: -w "filter expression". (see examples bellow)
  • If you do not provide a filter, all frames in the file will be computed (total airtime)
• Default consolidation interval is 1 second.
  • Fractions of a second can be used too.

Examples

1. To compute all airtime consumption for each one second interval:

./airtime.py -f capture.dump

2. To compute all traffic related to XOs in a 10 seconds consolidation interval:

./airtime.py -f capture.dump -i 10 -w "wlan contains 00:17:c4"

3. To use only icmp traffic and generate output in csv format:

./airtime.py -f capture.dump -w "icmp" -o csv

4. Only management traffic, over a file captured from an XO, consolidated at 100ms:

./airtime.py -f capture.dump -w "wlan.type == 0x0" --no-fcs -i 0.1

5. The same as above but using the pre-processed file and changing interval to 10ms:

./airtime.py -t capture.dump.tmp3 -i 0.01

6. icmp and path discovery traffic (the sum of both):

./airtime.py -f capture.dump -w "icmo or wlan_mgt.fixed.mesh_action" -o csv

Note that you need a properly patched wireshark to decode "wlan_mgt.fixed.mesh_action"

7. To have two separated set of datas (to later draw a graph on a spreadsheet):

 ./airtime.py -f capture.dump -w "icmp" -i 0.1 > output.csv
 ./airtime.py -f capture.dump -w "wlan_mgt.fixed.mesh_action" -i 0.1 >> output.csv

Note that you need a properly patched wireshark to decode "wlan_mgt.fixed.mesh_action"