How to match the (TSF) timestamp between CSI/IQ captures and the packets captured by tcpdump/wireshark

[JiaoXianjun]

While doing CSI/IQ capture according to the app notes (listed at the end of this discussion), Wi-Fi packets can be captured at the same time on board via tcpdump. Then we can match the packets captured by tcpdump to the CSI/IQ captured by our scripts, and check the related comprehensive packet information in the wireshark for a specific CSI/IQ capture index. Video: https://youtu.be/iiiINz7XTGA

This discussion introduces the method to capture Wi-Fi packets on openwifi board firstly, then shows how to identify the related packet in the wireshark for the interested CSI/IQ capture index.

(DO NOT forget to copy all latest files in openwifi/user_space/ on to the board openwifi directory, and update FPGA&Driver package according to https://github.com/open-sdr/openwifi#update-fpga or https://github.com/open-sdr/openwifi/blob/master/doc/app_notes/radar-self-csi.md#quick-start)

Method to capture the Wi-Fi packets and check the timestamp:

1. Setup the scenario/use-case of communication/sensing of your own with CSI/IQ capture.
2. Open an extra ssh session to the board, and run on board:

   tcpdump -i sdr0 -s 65535 -w openwifi.pcap
   

   If your sdr0 is already used/occupied as normal Wi-Fi communication NIC (the non-monitor mode, like: AP, Client), a virtual monitor NIC can be created and used for packet capture:

   iw dev sdr0 interface add mon0 type monitor && ifconfig mon0 up
   tcpdump -i mon0 -s 65535 -w openwifi.pcap
   

   Extra filter could be added to tcpdump (adjust it according to your purpose) to lower the capturing overhead.

   tcpdump -i mon0 ether dst 66:55:44:33:22:60 -s 65535 -w openwifi.pcap
   

3. While running tcpdump, you should also run those CSI/IQ phython scripts (side_info_display.py/iq_capture.py/iq_capture_2ant.py) on computer to do CSI/IQ capture in parallel. After enough data is collected, close the phython scripts then the tcpdump.
4. Copy the openwifi.pcap to a computer and open it by wireshark. Click a packet and browser to "802.11 radio information" --> "TSF timestamp". Normally you will see a integer number expressing the time in microsecond as in the following screenshot:
   
   This TSF timestamp is attached to the received packet in FPGA by reading the TSF timier value while PHY header is received:
   https://github.com/open-sdr/openwifi-hw/blob/14b1e840591f470ee945844cd3bb51a95d7da09f/ip/rx_intf/src/rx_intf_pl_to_m_axis.v#L201
   Then openwifi driver report this timestamp value (together with the corresponding packet) to Linux via:
   

   openwifi/driver/sdr.c

   Line 530 in 0ce2e6b

   rx_status.mactime = ( ( (u64)tsft_low ) | ( ((u64)tsft_high)<<32 ) );

   
   Please check Project document and this issue for more information about TSF operation.

Method to match the CSI/IQ capture to the packet in wireshark.

1. For CSI capture, the timestamp shown by Matlab script test_side_info_file_display.m can be used as filter rule directly in the wireshark for packet identifying. For example, the following command in Matlab will show the plot for capture index 1 (the last argument in the following Matlab command):

   timestamp = test_side_info_file_display([], [], 1);
   

   
   The related timestamp is 24414146. Then filter "wlan_radio.timestamp == 24414146" in the wireshark will identify the packet and it brings you the comprehensive information about that packet.
   

2. For IQ capture (single or dual antenna), the TSF timestamp shown by Matlab script test_iq_file_display.m/test_iq_2ant_file_display.m is the moment trigger condition is met, so it is not necessarily related to the TSF timestamp carried by the Wi-Fi packet. Here is an example:
   On zedboard:

   insmod side_ch.ko iq_len_init=4095
   ./side_ch_ctl wh11d4090
   (Pre-trigger length: 4090 samples)
   ./side_ch_ctl wh8d1
   (Trigger condition: Wi-Fi packet succeeds the FCS/CRC check)
   ./side_ch_ctl g
   

   On computer:

   python3 iq_capture.py 4095
   

   In Matlab:

   timestamp = test_iq_file_display(4095, [], 2);
   

   
   Above figure plots the IQ (and others) from the capture index 2. According to the parameters we set on board, it means that while a Wi-Fi packet FCS/CRC valid event is met, the 4090 IQ samples before this event are captured. The timestamp of this event is 73938301. As we know that 4090 samples means 4090/20 = 204.5us, so we can use this filter "wlan_radio.timestamp < 73938301 && wlan_radio.timestamp > 73938097" (the latter is 73938301-204) in the wireshark to show packets in this time range. Then the packet/packets can be seen/checked for detailed info in the wireshark:
   

https://github.com/open-sdr/openwifi/blob/master/doc/app_notes/csi.md
https://github.com/open-sdr/openwifi/blob/master/doc/app_notes/radar-self-csi.md
https://github.com/open-sdr/openwifi/blob/master/doc/app_notes/iq.md
https://github.com/open-sdr/openwifi/blob/master/doc/app_notes/iq_2ant.md
https://github.com/open-sdr/openwifi/blob/master/doc/app_notes/packet-iq-self-loopback-test.md