A city hall WLAN analyst reviewing a capture from the council chamber sees MCS and signal strength in the radiotap/PPI pseudo-header that the 802.11 MAC decode alone does not show. What should the analyst conclude about that metadata?
Select an answer to reveal the explanation.
Short Explanation
Think of radiotap like the sticky note a meter reader leaves on the envelope—the MAC letter is still inside, but the note tells you signal, MCS, and channel the stamp alone never shows. City hall captures get a lot smarter when you read that PHY sticky note instead of pretending the MAC decode has everything.
Full Explanation
Radiotap and PPI are capture pseudo-headers that expose PHY metadata—MCS, signal/noise, channel, and related fields—supplied by the sniffer driver rather than by the 802.11 MAC header itself. Expert protocol analysis uses those fields when correlating rate selection and RF conditions with frame exchanges. Relying only on MAC decode omits the PHY context needed for CWNE-depth troubleshooting.