Automatic Data Frame Slicing in Airtool

Troubleshooting Wi-Fi networks at the protocol level requires analyzing control, management, and data frames. When saving these frames to disk, capture files can grow quickly because data frames may contain large payloads. If you are interested only in the frame exchanges rather than their payloads, storing that data may be unnecessary.

Payload data may also be of little use when a wireless network uses encryption. Unless you can decrypt the traffic, the captured payload remains unreadable. Even on an unencrypted network, excluding payloads can help prevent the capture file from storing user data in plain text.

Packet slicing addresses these concerns by capturing only the beginning of each frame and discarding the remaining bytes. Ideally, you could specify a fixed capture length that preserves every 802.11 MAC header while excluding the payload. In practice, however, 802.11 MAC headers vary in length, so a fixed value does not work for every frame.

For example, the MAC header of a QoS data frame includes a QoS Control field, while the header of a non-QoS data frame does not. A frame transmitted through a wireless distribution system may also contain a fourth MAC address. Automatic slicing must therefore identify the frame’s header format before determining how many bytes to preserve. It must also examine the subtype because not every data frame carries an MSDU, and processing those frames unnecessarily would add overhead.

Airtool includes an option for automatic data-frame slicing. When enabled, Airtool stores only the 802.11 MAC header of eligible data frames in the capture file. It leaves any frame that fails the FCS check intact for two reasons. First, Airtool cannot reliably confirm that a corrupted frame is a valid data frame. Second, slicing it would prevent a protocol analyzer from determining whether the original frame passed or failed the FCS check, changing the meaning of the capture.

Although Airtool discards the payload when slicing is enabled, it records the frame’s original length in the capture metadata. You can therefore determine how many bytes the frame originally carried even though the payload itself is no longer present.

To enable data-frame slicing, click the Airtool icon and choose Preferences > General. Then select “Do not save Layer 3-7 payload (MSDU).”