As an illustration of how a RAW packet is built at the application level. The following demonstrates to build a PING packet encapsulated w/ ICMP, IP and MAC protocols.

1. First, there is the PING message that needs to be transmitted over WLAN PHY.
   Figure 15-5 Ping Data to be Sent
2. PING is an ICMP QUERY message, and hence, should first be encapsulated w/ ICMP header.
   Figure 15-6 Frame Format - ICMP
   1. ICMP TYPE is set to 0x08 since this is an ‘Echo-Request’ message.
   2. ICMP CODE will always be 0x00 for PING message.
   3. ICMP CHECKSUM is for header and data and is ‘0xA5, 0x51’ for our message.
   4. ICMP DATA is “PING data to be sent” defined above.
3. Before sending the ICMP encapsulated PING command to MAC layer, the messages should be encapsulated into IP data grams. Figure 15-7 shows the frame-format of IPv4 packet.
   Figure 15-7 Frame Format - IP
   1. VER is set to 4 since it is a IPv4 packet.
   2. HLEN is header length in ‘lwords’ - It will be set to 5 here since the header length is 20 Bytes.
   3. SERVICE TYPE is set to 0x00 since ICMP is a normal service.
   4. TOTAL LENGTH is set as ‘0x00 0x54’ bytes, which includes header and data length.
   5. VENDOR ID is set to 0x00, 0x00, 0x00.
   6. IDENTIFICATION is the unique identity for all data grams sent from this source IP – Let’s set it as ‘0x96, 0xA1’ for our packet.
   7. FLAG and FRAGMENTATION OFFSET is set to 0x00, 0x00 since there is no intent to fragment the packet. Reason: The packet being sent here is smaller than a WLAN frame size.
   8. TIME TO LIVE is set to 0x40 because the packet will be discarded after 64 hops.
   9. PROTOCOL is set to 0x01 since it is an ICMP packet.
   10. 2 Bytes is HEADER CHECKSUM, which is set to 0x57, 0xFA in this case.
   11. SOURCE IP ADDRESS is set to 0xc0, 0xa8, 0x01, 0x64 (which is 192.168.1.100).
   12. DESTINATION IP ADDRESS is set to 0xc0, 0xa8, 0x01, 0x65 (which is 192.168.1.101).
   13. OPTIONS field is left blank.
4. Next, LLC and MAC headers should be added to the IP encapsulated message. Figure 15-8shows the frame-format of LLC+SNAP header:
   Figure 15-8 Frame Format - IEEE 802.2 LLC (3 bytes) + SNAP (5 bytes)
   1. DSAP is set to 0xAA to specify that it is a SNAP frame.
   2. SSAP is set to 0xAA to specify that it is a SNAP frame.
   3. CONTROL FIELD is set to 0x03 for Sub-Network Access Protocol (SNAP).
   4. VENDOR ID is set to 0x00, 0x00, 0x00.
   5. PROTOCOL TYPE is set to 0x08, 0x00 – This is to indicate that the protocol at layer-4 is IP.
5. The message is finally encapsulated with the MAC header. Figure 15-9 shows the frame-format of 802.11 MAC header.
   Figure 15-9 Frame Format - 802.11 MAC

   FRAME CONTROL is set to 0x88, 0x02 because of below configuration:

   1. 2-Bits for Protocol Version are set as 00 for 802.11 standard.
   2. 2-Bits for Type are set as 10 for ‘Data’.
   3. 4-Bits for Subtype will set as 1000 for ‘QoS Data’.
   4. Frame Control Field 0x02 is to indicate that the frame is coming from a Distributed-System.
   5. DURATION ID is set to 44 μS.
   6. DESTINATION MAC ADDRESS is set to 0x00, 0x23, 0x75, 0x55,0x55, 0x55.
   7. BSSID MAC ADDRESS is set to 0x00, 0x22, 0x75, 0x55,0x55, 0x55.
   8. SOURCE MAC ADDRESS is set to 0x00, 0x22, 0x75, 0x55,0x55, 0x55.
   9. SEQUENCE CONTROL FIELD is set to 0x42, 0x80.
      1. Sequence Number is set to 1064 – It is the unique identity for all data grams sent from this source MAC.
      2. Fragmentation Number is set to 0 – Indicates that there is no fragmentation required.
6. The data packet is now encapsulated with ICMP, IP and MAC headers and is ready to be transmitted over WLAN PHY. The following is the complete packet.

   RawPingPacket[] = { 
                  /*---- 802.11 MAC Header -----*/
                         0x88,
                         0x02,
                         0x2C, 0x00,
                         0x00, 0x23, 0x75, 0x55,0x55, 0x55,
                         0x00, 0x22, 0x75, 0x55,0x55, 0x55,
                         0x00, 0x22, 0x75, 0x55,0x55, 0x55,
                         0x80, 0x42, 0x00, 0x00,
      /*---- LLC & SNAP Header -----*/ 
                         0xAA, 0xAA, 0x03, 0x00, 0x00, 0x00, 0x08, 0x00,
                         /*---- IP Header -----*/
                         0x45, 0x00, 0x00, 0x54, 0x96, 0xA1, 0x00, 0x00, 0x40, 0x01,
                         0x57, 0xFA,
                         0xc0, 0xa8, 0x01, 0x64,
                         0xc0, 0xa8, 0x01, 0x65,
                         /*---- ICMP Header -----*/
                         0x08, 0x00, 0xA5, 0x51,
                         0x5E, 0x18, 0x00, 0x00,
                  /*---- Payload -----*/
                         0x41, 0x08, 0xBB, 0x8D, 0x00, 0x00,
                         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                         0x00, 0x00, 0x00, 0x00
                         };

7. To decode the packet, the received response can be unpacked with the following in mind:
   1. CC3x00 device will add 8 Bytes of proprietary radio header to the received packet. The header will have important information about the packet.
      1. 1 Byte (unsigned char) for RATE: This has rate of data reception.
      2. 1 Byte (unsigned char) for CHANNEL: This has the channel-number on which the data is received.
      3. 1 Byte (signed char) for RSSI: It has the computed RSSI value (in dB) of the current frame.
      4. 1 Byte for PADDING-BITS: It’s for 4B alignment.
      5. 4 Byte (unsigned long) for TIMESTAMP: Timestamp (in μS) of the received packet. The received messages are tagged with system-time, which by-default starts from 1-1-2000.
   2. The actual data will follow this 8 Byte header and the application developers should parse it as per their protocol.
   3. Considering 8 Bytes of proprietary radio header that gets added to the received packet, 802.11 MAC Header starts from offset-8 of the received packet.
      1. DESTINATION MAC ADDRESS (6 Byte information) is at offset-4 of 802.11 MAC Header and hence can be extracted starting from offset-12 of received packet.
      2. SOURCE MAC ADDRESS (6 Bytes information) is at offset-16 of 802.11 MAC Header and, hence, can be extracted starting from offset-24 of received packet.
   4. Considering 8 Bytes of proprietary radio header, 26B of MAC header and 8B of LLC & SNAP header, IP-Header starts from offset-42 of received packet.
      1. SOURCE IP ADDRESS (4 Byte information) is at offset-12 of ‘IP Header’ and hence can be extracted starting from offset-54 of received packet.
      2. DESTINATION IP ADDRESS (4 Byte information) is at offset-16 of ‘IP Header’ and, hence, can be extracted starting from offset-58 of received packet.
   5. The rest of the packet can be decoded as per the next level protocol, and the final decoding code will look like the following:

   typedef struct { 
      UINT8   rate;
      UINT8   channel;
      INT8    rssi;
      UINT8   padding;
      UINT32 timestamp;
   } 
   TransceiverRxOverHead_t; 
   void TransceiverModeRx (INT8 <channel_number>, INT32 <pkts_to_receive>) { 
      TransceiverRxOverHead_t *frameRadioHeader = NULL;
      UINT8 buffer[BUFFER_SIZE] = {'\0'};
      INT32 <socket_hanlde> = -1;
      INT32 recievedBytes = 0;
      <socket_hanlde>= sl_Socket(SL_AF_RF, SL_SOCK_RAW, <channel_number>);
      while(<pkts_to_receive>--)
      {
          memset(&buffer[0], 0, sizeof(buffer));
          recievedBytes = sl_Recv(<socket_hanlde>, buffer, BUFFER_SIZE, 0);
          frameRadioHeader = (TransceiverRxOverHead_t *)buffer;
          PRINT(" ===>>> Timestamp: %iuS, Signal Strength: %idB\n\r", frameRadioHeader->timestamp, frameRadioHeader->rssi);
          PRINT(" ===>>> Destination MAC Address: %02x:%02x:%02x:%02x:%02x:%02x\n\r", buffer[12], buffer[13], buffer[14], buffer[15], buffer[16], buffer[17]);
          PRINT(" ===>>> Source MAC Address: %02x:%02x:%02x:%02x:%02x:%02x\n\r", buffer[24], buffer[25], buffer[26], buffer[27], buffer[28], buffer[29]);
          PRINT(" ===>>> Source IP Address: %d.%d.%d.%d\n\r", buffer[54],  buffer[55], buffer[56],  buffer[57]);
          PRINT(" ===>>> Destination IP Address: %d.%d.%d.%d\n\r", buffer[58],  buffer[59], buffer[60],  buffer[61]);
      }
      sl_Close(<socket_handle>);