Link-Layer Header Types: What Do I Need to Know?

Airtool is a menu bar app for macOS that makes it easy to capture 802.11 frames on one or more channels. One of its options lets you select the link-layer header type stored with each captured frame. This article describes the header types available for a Mac’s built-in Wi-Fi adapter, explains their differences, and helps you choose the appropriate format for your captures.

Understanding Link-Layer Header Types

Many link-layer header types exist, but a Mac’s Wi-Fi driver may support only a subset. Common options include Ethernet, 802.11, 802.11 plus Radiotap, 802.11 plus AVS radio information, Per-Packet Information, and Raw IP. Wireshark and Airtool list only the formats supported by the Mac on which they are running.

Some of these formats include a pseudo-header. Unlike an 802.11 header, a pseudo-header is not transmitted over the air. The Wi-Fi driver adds it during capture to provide metadata about the frame, such as its channel, data rate, signal strength, and noise level.

Ethernet

The Ethernet header type presents captured network traffic as Ethernet, or 802.3, frames. When you select this format, the driver translates eligible 802.11 data traffic into Ethernet frames. The capture does not retain the original 802.11 MAC headers, and it does not include 802.11 management or control frames.

Native 802.11

The 802.11 header type preserves native 802.11 control, management, and data frames. However, it does not include a pseudo-header, so the capture lacks additional radio metadata supplied by the driver.

Pseudo-Headers and Radio Metadata

The 802.11 plus Radiotap, 802.11 plus AVS radio information, and Per-Packet Information formats add pseudo-headers to native 802.11 frames. Of these, Radiotap is the most widely used.

802.11 Plus Radiotap

The 802.11 plus Radiotap format stores a Radiotap header before each 802.11 frame. Radiotap provides a standard mechanism for drivers to pass metadata about received frames to user-space applications. It can also carry transmission parameters from an application to a driver when frame injection is supported. The format is extensible, and the fields present in a given header depend on the driver and the information available for that frame.

A Radiotap header may include fields such as:

• Channel: The transmit or receive frequency in MHz.
• Rate: The transmit or receive data rate.
• Antenna Signal: The RF signal power measured at the antenna, in dBm.
• Antenna Noise: The RF noise power measured at the antenna, in dBm.
• Flags: Frame properties such as the presence of an FCS, fragmentation, or a short preamble.
• MCS: The MCS index and related properties, such as channel width, guard interval, and HT format.
• A-MPDU Status: Information indicating that the frame was received as part of an A-MPDU.
• Antenna: The index of the antenna used to transmit or receive the frame.
• VHT: Properties of VHT transmissions, such as STBC, guard interval, and beamforming information.

You can find the complete list of defined Radiotap fields here.

Radiotap headers are available when the Wi-Fi adapter operates in monitor mode. When capturing with Wireshark, make sure monitor mode is enabled. Airtool performs captures in monitor mode automatically.

Per-Packet Information

The Per-Packet Information format stores a PPI header before each 802.11 frame. PPI resembles Radiotap because it is a general, extensible format for carrying out-of-band radio metadata. A PPI header consists of a packet header followed by zero or more type-length-value (TLV) fields. Although the format was originally designed to carry information about 802.11n frames, it can represent metadata for other 802.11 technologies as well.

Like Radiotap, a PPI header may include fields for the data rate, channel frequency, channel flags, antenna signal, and antenna noise. You can find a more complete description of PPI fields here.

802.11 Plus AVS Radio Information

The 802.11 plus AVS radio information format uses another pseudo-header designed to describe captured 802.11a and 802.11g frames. The AVS header is 64 bytes long and may include the PHY type, channel, data rate, antenna index, signal strength, noise level, and other radio information.

Raw IP

Finally, the Raw IP format stores IP datagrams without their original 802.11 or translated 802.3 headers. Because it omits link-layer information, it is rarely useful for 802.11 protocol analysis.

Which Header Type Should You Choose?

For detailed 802.11 packet and protocol analysis, 802.11 plus Radiotap and Per-Packet Information provide valuable radio metadata in addition to the contents of the 802.11 frames. Radiotap has broad tool support and is the default link-layer header type in Airtool and in Wireshark when capturing from a Wi-Fi interface.