TZSP

Key takeaways

TZSP belongs to computer science; place it in that map before memorising details.
Learn the definition first, then one example that makes the definition concrete.
Connect TZSP to a quantity you can measure, compute or draw — that is where exam questions come from.
Reproduce the core statement of TZSP from memory before moving on to harder problems.

Reference excerpt

TaZmen Sniffer Protocol (TZSP) is an encapsulation protocol used to wrap other protocols. It is commonly used to wrap 802.11 wireless packets to support Intrusion Detection Systems (IDS), wireless tracking, or other wireless applications.

Protocol Summary A number of 802.11 sensors and Access Points use the TZSP protocol for packet capture. It is an open protocol that was designed to encapsulate other protocols over UDP. The primary use for this protocol has been the capture of wireless traffic and transmission of them over a wired network.

Protocol Header The protocol specified three parts to each TZSP packet: A 4-byte header followed by one or more tagged fields, the last of which has to be the TAG_END(0x01), and finally the encapsulated data. The header and tagged fields use big-endian ordering where appropriate.

Version The TZSP version should always be set to 1 (0x01).

Type 0 (0x00) Received tag list 1 (0x01) Packet for transmit 2 (0x02) Reserved 3 (0x03) Configuration 4 (0x04) Keepalive 5 (0x05) Port opener

Encapsulated Protocol 1 (0x01) Ethernet 18 (0x12) IEEE 802.11 119 (0x77) Prism Header 127 (0x7F) WLAN AVS

Tagged Fields The tagged fields consist of a one-byte tag type, followed by a one-byte tag length, followed by a variable amount of data. The tag length does not include the tag type or tag length. All TZSP compatible decoders should skip unknown tagged fields.

<1 unsigned byte > Tag Type <1 unsigned byte > Tag Length <variable length > Dependent on Tag Length

There are two exceptions to this format. First, when a TAG_END (0x01) is received it is the end of all of the tagged fields. It DOES NOT have a Tag length nor any associated data. The second is the TAG_PADDING (0x00). This can be inserted at any point and should be ignored. It DOES NOT have a tag length nor any tag data. The following are the valid TZSP tag types: TAG_PADDING = 0 (0x00) This special tagged field has neither tag length nor any tag data. The receiver should ignore it. It is sometimes used to pack the frame to a word boundary. TAG_END = 1 (0x01) This special tagged field has neither tag length nor any tag data. This means that there are no more tags. Following this tag, until the end of the UDP packet, is the encapsulated frame. This is the only tag that is required and must be included before the encapsulated data. No variable tags can follow this one. TAG_RAW_RSSI = 10 (0x0A) This field contains the raw RSSI obtained from the sensor. The data is either a signed byte or signed short. TAG_SNR = 11 (0x0B) This field contains the raw noise obtained from the sensor. The data is either a signed byte or signed short. TAG_DATA_RATE = 12 (0x0C) This field contains the data rate the encapsulated packet was transmitted at. The following are valid values that can be used:

2 (0x02) = 1 MB/s 4 (0x04) = 2 MB/s 11 (0x0B) = 5.5 MB/s 12 (0x0C) = 6 MB/s 18 (0x12) = 9 MB/s 22 (0x16) = 11 MB/s 24 (0x18) = 12 MB/s 36 (0x24) = 18 MB/s 44 (0x2C) = 22 MB/s 48 (0x30) = 24 MB/s 66 (0x42) = 33 MB/s 72 (0x48) = 36 MB/s 96 (0x60) = 48 MB/s 108 (0x6C) = 54 MB/s

The following are old constants that may be used in old Prism-based sensors. A TZSP decoder should be able to decode them but they should NOT be used in a TZSP encoder:

10 (0x0A) = 1 MB/s 20 (0x14) = 2 MB/s 55 (0x37) = 5.5 MB/s 110 (0x6E) = 11 MB/s

TAG_TIMESTAMP = 13 (0x0D) This is the time the sensor MAC received the packet. It is a 4-byte unsigned int. TAG_CONTENTION_FREE = 15 (0x0F) This is used to tell if the packet was sent in a contention free period. It is a 1-byte unsigned byte. TAG_DECRYPTED = 16 (0x10) This is used to tell if the packet was decrypted. It is a 1-byte unsigned byte. TAG_FCS_ERROR = 17 (0x11) This is used to tell if the packet had a frame check sequence (FCS) error in reception. It is a 1-byte unsigned byte. A one (0x01) specifies that there was an FCS error on the decoding of the packet. A zero (0x00), or the exclusion of this field means that there was no decoding error. All other values are reserved. TAG_RX_CHANNEL = 18 (0x12) This is the channel the sensor was on when it captured the packet. It is NOT the channel the packet was transmitted on. This is stored as an unsigned byte. TAG_PACKET_COUNT = 40 (0x28) This is a monotonically increasing packet count. It is stored as a four byte unsigned int. TAG_RX_FRAME_LENGTH = 41 (0x29) This is the received packet length. It is not necessarily the size of the transmitted packet, which may have been truncated. This is stored as a two byte unsigned short. TAG_WLAN_RADIO_HDR_SERIAL = 60 (0x3C) This is used by some sensor vendors to specify the serial number or other unique identifier for the sensor or AP that captured the packet. This is a variable length field.

Encapsulated Packet The encapsulated packet should be stored immediately after the tagged fields. This encapsulated packet may be truncated from the original full packet size and does not need to be the same size as specified in the TAG_RX_FRAME_LENGTH field. It is assumed that the encapsulated packet takes up the entire rest of the UDP packet.

Open Source Support Snort Wireshark tzsp2pcap

References

External links Archived documentation

Worked examples

Example 1 — a first encounter with TZSP

Start with the simplest possible case. Write down what TZSP claims or describes in one sentence, then invent the smallest concrete situation in which that sentence is true. In computer science, the smallest case is usually a single object, a single equation or a single measurement. Check that every symbol or term in your sentence has a meaning in that case.

Example 2 — changing one variable

Take the situation from Example 1 and change exactly one quantity: double it, halve it, or set it to zero. Predict what should happen to TZSP before you calculate. Comparing your prediction with the result is the fastest way to find out whether you understand the idea or only the words.

Example 3 — an exam-style question

Typical questions about TZSP ask you to (a) state it precisely, (b) apply it to given data, and (c) explain a limitation. Practise writing all three answers in under five minutes; the third part is what separates a full-mark answer from an average one.

Applications of TZSP

In research: TZSP appears in computer science research whenever the underlying quantities have to be modelled precisely. Papers usually cite it as a starting assumption and then explore where it breaks down.
In technology and industry: Engineering practice reuses TZSP in design rules, simulations and safety margins. Knowing the idea lets you read a specification sheet and understand why the numbers look the way they do.
In the classroom: TZSP is common in secondary-school and first-year university syllabi. It links to neighbouring topics Application layer protocols, Internet protocols, Intrusion detection systems, so understanding it makes those chapters shorter.
In everyday life: Look for TZSP outside the textbook — in sport, cooking, traffic, electronics or the sky above you. An example you found yourself is remembered far longer than one you were given.

How to study TZSP in 20 minutes

Read the reference excerpt below once, without taking notes.
Close the page and write down what TZSP means in your own words.
Compare your version with the excerpt and mark what you missed.
Work through the three examples above with pen and paper.
Explain TZSP out loud to somebody else — or to Teacher Smith in the lgStudy chat.

Frequently asked questions

What is TZSP in simple terms?

TaZmen Sniffer Protocol (TZSP) is an encapsulation protocol used to wrap other protocols. It is commonly used to wrap 802.11 wireless packets to support Intrusion Detection Systems (IDS), wireless tracking, or other wireless applications.

Why does TZSP matter?

Because it connects several computer science ideas at once: it gives you a definition you can apply, a quantity you can calculate, and a way to check whether a result is plausible.

How should I study TZSP?

Read the excerpt, restate it from memory, then work through the examples and applications listed on this page. The five-step study plan above takes about twenty minutes.

What does this page cover?

It gives you a compact reference excerpt plus original lgStudy explanations, examples, applications and study material on TZSP.