Category: Protocol Analysis

Posted on

How to use WLANPi as a capture adapter in Wireshark 4.x on Windows

This is a very quick article to help anyone trying to setup the WLANPi as a capture adapter in Wireshark 4. I only tried it with the WLANPi Pro and Wireshark 4.0.1 on my Windows 10 laptop, so apologies if your experience differs, but I’m hoping this post contains enough info to get you started if you’ve never done this before.

This post also assumes your WLANPi has an IP address and you can SSH to it from the Wireshark laptop. It may be possible to connect to the WLAN using the USB-OTG or some other means but I’ve not tested it and will only be looking at the SSH method here.

Continue reading “How to use WLANPi as a capture adapter in Wireshark 4.x on Windows”
Posted on

Why are my Wireshark Neighbor Report filters broken?

Just a short post to inform people that Wireshark have deprecated the filter ‘wlan.rm’ (which I presume stood for Radio Measurement) and moved the subfilters into ‘wlan.fixed’. This happened in Wireshark version 3.2.10.

For Neighbor Report Requests this is the change:
Old: wlan.rm.action_code == 4
New: wlan.fixed.action_code == 4

For Neighbor Report Responses this is the change:
Old: wlan.rm.action_code == 5
New: wlan.fixed.action_code == 5

Posted on

How to verify whether 802.11k and 11r are enabled (via a capture)

I was chatting with my old colleague and friend Vince Folk from Vocera recently when he challenged me to name the Information Elements you would find 802.11k/r settings in.

Immediately my smugness shot to Maximum because this is something I’m very familiar with, you might even have seen my WLPC EU 2019 video analysing 802.11k/r/v. However, as the biotic hamsters in my dusty shell of a skull scurried around trying to find the grey matter holding this information my smugness waned.

When Vince finally put me out of my misery the IE names did not ring a bell with me. Not a single one! So the only reasonable course of action was to blog about it, to cement it into the aforementioned grey matter, and hopefully help someone else out too.

Continue reading “How to verify whether 802.11k and 11r are enabled (via a capture)”
Posted on

Will we be able to capture 802.11ax frames?

This blog post started out as a question to Jim Vajda on Twitter, but I quickly realised there were too many facets to the question for 240 characters. So I thought I’d lay my thoughts out in a blog post instead.

While listening to Jim on the The Wireless Pubcast (ep 16) the topic of capturing frames in an 802.11ax world was brought up. Several distinguished people in the Wi-Fi community have suggested that we won’t be able to capture frames using anything but the associated AP. Jim talked this through with the strange gentlemen from the Pubcast and this is my counter opinion/confusion on the topic.

Continue reading “Will we be able to capture 802.11ax frames?”
Posted on

Why I dislike DFS channels, and you might too

As many of you know, I’m a voice guy. And in voice every millisecond counts. That is the main reason why I dislike DFS channels, because they introduce significant delay, which is lost time. But how bad can the lost time really be? And why do you care if you’re not running voice? Well folks, flick the lights on, pull the cover close and read on… it gets scary (yes, scarier than Ghost Frames™).

Continue reading “Why I dislike DFS channels, and you might too”
Posted on

Finding Neighbor Reports in a Wireshark capture

I was looking through a packet frame capture today and noticed some Neighbor reports for the first time. While I had the opportunity I thought it would be useful to grab the Wireshark filter for them. I then did way too much thinking and realised I should put them into a blog post.

Note: I will now revert to the queens English and return the U’s into the word Neighbour.

Continue reading “Finding Neighbor Reports in a Wireshark capture”

Posted on

What EAP type is it using?

As part of my role I assess existing WLAN’s for Voice support. During the survey I like to independently verify as much of the information I’ve been given as possible using protocol analysis.. One setting that I always struggled to find was the security in use, particularly when EAP / Dot1X was in use.

I had most of it figured out and was able to answer my last few questions when I took the CWAP course recently with Peter Mackenzie (@MackenzieWiFi). So here is a look at spotting the security in use on an SSID.

Continue reading “What EAP type is it using?”