Analyzing Wireless Packet Captures

Monitor Mode for Wireless Packet Captures

There are different wireless card modes like managed, ad-hoc, master, and monitor to obtain a packet capture. Monitor mode for packet captures is the most important mode for our purpose as it can be used to capture all traffic between a wireless client and AP. A client running Wireshark in monitor mode would listen to all packets it can hear in the air and the device will stop transmitting and receiving any of its own data.

 

802.11 Packet Structure

The main difference between wired and wireless packets is the addition of an 802.11 header. There are three major 802.11 frame types.

• Management frames: These packets are used to discover APs and to join a BSS. Some important subtypes are Beacon, Probe Request & Response, Authentication & Deauthentication, Association, and Disassociation
• Control frames: These packets are used to acknowledge successful transmission and reserve the wireless medium. Control packets allow for the delivery of management and data packets. Common subtypes are ACK, request-to-send, and clear-to-send
• Data frames: These packets contain actual data and are the only packets that will be forwarded from the wireless to the wired network. Types of data frames include Data, and null function

Analyzing Packet Captures

This monitor mode packet capture has a client who has successfully connected to the AP.  It can be used as a reference for the subtopics below for analyzing the wireless packets.

Physical Layer

Unlike wired packet analysis, the wireless physical layer is more complex. It is important to get an understanding of the physical layer of the capture before diving into the capture to analyze the upper layers. Some important physical layer values you need to be aware of are channel, data rate, and signal strength.

 

• Channel (frequency): As a wireless LAN may support anywhere from 3 to 25 different channels, it’s crucial to know exactly which channel(s) your capture was taken from.  If your intention is to get a capture focused on a specific AP, then lock your capture to that AP’s channel, and validate that the capture was on that channel
• Data rate: To understand why data transmissions don’t always make it from a transmitter to receiver, you must know what data rates are being used
• Signal strength: Signal strength indicates the power level in dBm at which the sniffing adapter received the packet. This information is useful for determining the expected quality of the signal

 

Signal strength	Expected Quality
-90dBm	Chances of connecting are very low at this level
-80dBm	Unreliable signal strength
-67dBm	Reliable signal strength– the edge of what Cisco considers to be adequate to support Voice over WLAN
-55dBm	Anything down to this level can be considered excellent signal strength.
-30dBm	Maximum signal strength, you are probably standing right next to the access point.

802.11 Client Authentication Process

 

Based on 802.11 specifications, the client authentication process consists of the following:

1. Access points (APs) continuously send out beacon frames which are picked up by nearby WLAN clients, advertising their SSIDs and data rates
2. The client broadcasts probe request frames on every channel, to all APs. Probe requests advertise the mobile stations supported data rates and 802.11 capabilities such as 802.11n
3. Access points within range respond with a probe response frame, advertising the SSID (wireless network name), supported data rates, encryption types if required, and other 802.11 capabilities of the AP
4. The client decides which AP is the best for access (based on compatibility with received probe responses) and sends an authentication request to the AP it deems best to connect to
5. The access point sends an authentication reply, inviting the client to authenticate to the SSID
6. Upon successful authentication, the client sends an association request frame to the access point
7. The access point will reply with an association response with a success message, granting network access to the client
8. The client is now able to pass traffic to the access point

 

Here is an example of a complete client authentication process from the above packet capture.

 

The packet capture is shown here in Wireshark. The display filter used was "wlan.addr == 00:21:6b:f7:3a:d2 and (wlan.fc.type == 0x00 or eapol)"

 

 

As mentioned above in the 802.11 packet structure section, there are 3 types of frames used in 802.11 MAC layer communications happening over the air which manage and control the wireless link. The management, control, and data frames. The sections below investigate those frames with the help of packet capture given above.

Beacon Frame

The beacon frame is one of the most information-dense wireless packets. The access point sends a beacon frame as a broadcast to announce its presence to any wireless clients. It relays information about the parameters that must be set on the client side in order to connect to it. Radio NICs continually scan all 802.11 radio channels and listen to beacons as the basis for choosing which access point has the best signal and availability to associate with.

 

 

SSID parameter set: The SSID (network name) broadcasted by the access point

Supported rates: The data transfer rates supported by the access point

DS parameter set: The channel on which access point is broadcasting