802.11 Finding the MCS rate in Wireshark
December 19, 2019
Posted by on
One great way to troubleshoot wireless issues that clients might be having is to perform a packet capture or use some kind of wireless analysis tool. In this case I have an Ekahau sidekick with Capture. Before this tool I used Ubuntu, Wireshark, and a compatible wireless adapter to capture packets. The MCS or Modulation and Coding Scheme value indicates a lot about the client. For example, the MCS rate is as really a reference number given to the combination of – amount of Spatial streams, Modulation type and coding scheme. Analyzing the MCS helps when we need to troubleshoot the common problem of “its slow” while everything looks good.
I look at the MCS rate when troubleshooting client problems for a lot of reasons. Since the MCS rate is a reference number describing how much data can be sent over the wireless medium, it gives us an idea of the wireless environment. If the spectrum has lots of contention/interference or the client has low RSSI then the MCS will reflect this. If clients have lots of retrys, or a low RSSI then it will lower the modulation scheme, and therefore lower the MCS rate.
Lets take a look at a 802.11ac packet in Wireshark and break down what each section means. The MCS is located in the Data frame under the 802.11 Radio information section.
This packet is captured from a Data frame, you will notice the MCS rates are only captured on data packets – Lots of reasons for this. Most management/control frames are sent with the lowest data rate possible to allow them to be understood by clients far away, or if the network is very congested.
In this example we are looking at an 802.11ac frame, and we see right away the MCS index is 7 – from looking at the MCS chart we see that means modulation:64 QAM, which a number 5/6 . The 5/6 is the actual FEC or Forward error correction coding rate, which is given in fraction form. 5/6 equals to 0.83333.. which means that 83% of the data stream can be used to send real data. 5/6 is the highest coding rate.
We can see that the host has 2 Spatial streams, is using a Short guard interval , 40 MHz channel and the data rate is 300 – the data rate is the highest capable with these settings. Notice the RSSI is -44 and we are just using 64 QAM, you really have to be close and have a clear spectrum to achieve 256 QAM.
Below is the table of MCS rates for 802.11AC/N – Compliments of WLANPROS.com