Monday, 17 February 2014

WLAN Packet Capture - Wi-Fi Filter Categories in Wireshark

Wireshark has an expression builder to help build filter expressions to filter out the frames that perhaps you don't want to see, or to allow you to select the frames would like to view.

At first glance, the categories are pretty overwhelming due to the fantastic array of protocols that Wireshark can decode for us. I certainly had to dig around a little the first time I looked through the list before I found the WiFi related categories.

I thought it might be useful to list the categories (that I have found so far!) that relate to WiFi traffic.  Here is the list, together with a brief description of each one:
  • 802.11MGT - IEEE 802.11 Wireless LAN management frame
  • 802.11MGT - Radiotap - IEEE 802.11 Radiotap Capture Header
  • IEEE 802.11 - IEEE 802.11 wireless LAN
  • IEEE 802.11 Aggregate Data - IEEE 802.11 wireless LAN aggregate frames
  • Wi-Fi P2P - Wi-Fi Peer-to-Peer



WLAN Packet Capture - Displaying Only 802.11 Decodes in the Frames Summary

I quite like to be able to see the frame type, sequence numbers and flags field when looking at a summary of an 802.11 capture in Wireshark. 

However, Wireshark can be too helpful when decoding frames and  will display a summary of the frame which shows the detail of hight layer protocols (thus hiding the 802.11 summary info). This generally happens when decoding a capture of a WiFi network that has a guest network that is not using over the air encryption.

Here is an example. Some data frames in the trace summary below are shown as 'https' or 'Application Data' frames, rather than layer 2 data frames:



To prevent this behaviour, simply go to the "Analyze > Enabled Protocol" menu option in Wireshark and de-select 'LLC':



This will restore the standard 802.11 frame summary so that 802.11 frame types, flags etc. are available:



One thing to bear in mind with this approach is that some exchanges you would normally decoded (e.g. EAP exchanges and 4 way handshake) will suddenly become just data frames - so use with care.







Sunday, 16 February 2014

WLAN Packet Capture - Frame Colorization in Wireshark

Generally, when capturing and decoding frames in a wired network, there isn't a huge amount of interest going on at layer 2 of the OSI stack. There is pretty much one type of frame at the data link layer (i.e. an Ethernet frame), with all of the real 'interesting' stuff going on in layer 3 and above.

However, when looking at 802.11 wireless packet capture and decoding, there are a whole host of different frames types at layer 2 that we might see. (As a side note, layer 3 and above are often inaccessible to us in wireless captures as the payload of our layer 2 frames may be encrypted, rendering upper layers impossible to view.)

There are actually 3 types of frames we might see at layer 2 when performing a wireless capture:
  • Management frames - these frames are used by wireless stations to join and leave a wireless network
  • Control frames - these are used to assist with the delivery of data frames
  • Data frames - these contain the actual higher-layer data that we want to get across our wireless network (i.e. layer 3 and above of the OSI stack )
In addition, each of these frame types has a multitude of sub-types that we may well see during the course of our wireless analysis. For instance, management frames may be beacons, association requests, authentication frames or perhaps probe requests. Control frames may includes Acks, RTS or perhaps CTS frames. Hopefully, you get the idea that there are quite a few different frame types you may see.

  As you learn more about 802.11 frame types and sequences, you will become familiar with the various frame types and their function. However, when viewing a summary of an 802.11 capture in Wireshark, the line after line of  black text on a white background that Wireshark presents by default is quite difficult to study and understand.

Luckily, Wireshark allows us to employ some very useful colorization rules that allow us to color the frames shown in our summary screen to give us a few clues about what is going on.
As an example, have a look at the capture summary shown below:


If you look at this summary carefully, you can see that we have probe requests & probe responses ('management' frames), Acknowledgement (Ack) and CTS frames ('control' frames), together with QoS data frames (obviously, 'data' frames). However, it is quite tricky to see the different frame types unless you understand which group each frame sub-type belongs to.

However, if we employ some fancy rules using the Wireshark colorization feature, we can colour each frame type and sub-type to give us some really useful visual cues about the frame types we are looking at, which in turn may help us to understand what is going on.

To access the colorization rules, you will need to go along to the Wireshark menu item: View > Coloring Rules



On the left side of the Coloring Rules panel, you will see a button labelled 'Import'. Using this, we can import a text file containing colorization rules for each type and subtype of 802.11 frame. You can download a colorization file from here: link

Once you download this file (which is a simple text file) and import it, you will then see each frame type and sub-type displayed in a variety of colors in your Wireshark capture summary. If we re-visit our previous example, it now looks like this:


To give the colors displayed a little more context, here is how the colorization has been configured:
  • Management frames are colored using varying shades of purple
  • Control frames are colored with varying shades of orange/brown
  • Data frames are colored with various shades of blue
Each sub-type will have a unique shade of colorization within its frame type, however the main point of interest is the instant visual clue you get about whether a frame is a management, control or data frame type. You also start to get a feel for how many of each type of frame you are actually looking at. I found it quite surprising at first just how many management frames are actually flying back and forth in each capture when I first started to use colorization for my capture file analysis.

  I'd like to claim that it was in fact myself who had been smart enough to figure out this superb colorization scheme for 802.11 frames - but, I'm not that smart :) This colorization scheme was put together by (and is used with permission from) Trent Culter (@FireMyWires on Twitter). He actually put this colorization scheme together during his time at Metageek. It reflects the colorization scheme used within Metageek's EyePa analysis product (which I strongly recommend that you check out). I have found the colorization incredibly useful when looking at wireless captures within Wireshark - it gives you some great visual cues about what is going on when looking at a capture summary. Hopefully, if you find it as useful as I have, you might drop Trent a note of thanks for his efforts in putting this together.

Useful Link:

Wireshark colourization file download

*** Oct 2017 - HERE IS A MUCH BETTER OPTION *** https://support.metageek.com/hc/en-us/articles/115013527388