From: David Gwynne <david@gwynne.id.au>
Subject: Re: make tcpdump show 802.11 QoS TID
To: tech@openbsd.org
Date: Fri, 5 Dec 2025 21:30:50 +1000

On Thu, Dec 04, 2025 at 11:03:42AM +0100, Stefan Sperling wrote:
> Make tcpdump show the QoS TID with -v.
> Avoids a roundtrip into wireshark for me when debugging QoS related stuff.
> 
> OK?

tcpdump provides EXTRACT_16BITS(), which you could use instead of memcpy
and the byteswap when printing. up to you though, tcpdump isnt known
for internal consistency.

either way is ok by me.

> 
> M  usr.sbin/tcpdump/print-802_11.c  |  6+  0-
> 
> 1 file changed, 6 insertions(+), 0 deletions(-)
> 
> commit - 518016afd7445de7b41ff08566393e1fcdc5b157
> commit + bd014d40ff0fb8fb204496f92d2b358ae3f540a3
> blob - b6b7ade0f2e41151ce96a6c3763e28cc2c7fabba
> blob + dddcba1cf65e8480b42ebfda0518eaf0213830ac
> --- usr.sbin/tcpdump/print-802_11.c
> +++ usr.sbin/tcpdump/print-802_11.c
> @@ -187,6 +187,7 @@ ieee80211_data(struct ieee80211_frame *wh, u_int len)
>  	    (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_QOS)) ==
>  	    (IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_QOS));
>  	u_char *esrc = NULL, *edst = NULL;
> +	uint16_t qos = 0;
>  
>  	if (hasqos) {
>  		struct ieee80211_qosframe *wq;
> @@ -195,6 +196,7 @@ ieee80211_data(struct ieee80211_frame *wh, u_int len)
>  		TCHECK(*wq);
>  		t += sizeof(*wq);
>  		datalen = len - sizeof(*wq);
> +		memcpy(&qos, wq->i_qos, sizeof(qos));
>  	} else {
>  		TCHECK(*wh);
>  		t += sizeof(*wh);
> @@ -224,6 +226,7 @@ ieee80211_data(struct ieee80211_frame *wh, u_int len)
>  			datalen = len - sizeof(*w4);
>  			esrc = w4->i_addr4;
>  			edst = w4->i_addr3;
> +			memcpy(&qos, w4->i_qos, sizeof(qos));
>  		} else {
>  			struct ieee80211_frame_addr4 *w4;
>  
> @@ -237,6 +240,9 @@ ieee80211_data(struct ieee80211_frame *wh, u_int len)
>  		break;
>  	}
>  
> +	if (hasqos & vflag)
> +		printf("TID %u ", le16toh(qos) & IEEE80211_QOS_TID);
> +
>  	if (data && esrc)
>  		llc_print(t, datalen, datalen, esrc, edst);
>  	else if (eflag && esrc)
>