SlideShare a Scribd company logo

Using WireShark with AirPCAP

•
•
David Sweigert
David Sweigert

The document summarizes a presentation on analyzing wireless local area networks (WLANs) using Wireshark and AirPcap. The presentation covers setting up Wireshark with AirPcap, capturing WLAN data, analyzing various WLAN frame types, and troubleshooting issues like clients not associating, roaming problems, and throughput issues. It provides details on WLAN management, control, and data frames, decryption, and analyzing scenarios like roaming and mixed 802.11b/g environments.

Related slideshows

WLAN(802.11AX - WI-FI 6) Evolution, frequency band, channels & use cases
WLAN(802.11AX - WI-FI 6) Evolution, frequency band, channels & use casesWLAN(802.11AX - WI-FI 6) Evolution, frequency band, channels & use cases
WLAN(802.11AX - WI-FI 6) Evolution, frequency band, channels & use cases
 
5G Core Network White Paper
5G Core Network White Paper5G Core Network White Paper
5G Core Network White Paper
 
Prof. Andy Sutton: 5G RAN Architecture Evolution - Jan 2019
Prof. Andy Sutton: 5G RAN Architecture Evolution - Jan 2019Prof. Andy Sutton: 5G RAN Architecture Evolution - Jan 2019
Prof. Andy Sutton: 5G RAN Architecture Evolution - Jan 2019
 
1 of 56
Download to read offline
SHARKFEST '09 | Stanford University | June 15–18, 2009 Analyzing WLANs with Wireshark & AirPcap Sessions BU-5 Rolf Leutert Consultant & Trainer | Leutert NetServices, Switzerland SHARKFEST '09 Stanford University June 15-18, 2009
SHARKFEST '09 | Stanford University | June 15–18, 2009 • Setting up Wireshark with AirPcap • Capturing WLAN data • WLAN Management, Control & Data Frames • WLAN Frame Formats • Analyzing: Client can not associate • Analyzing: Roaming problems • Analyzing: Throughput issues • Multiple-Input, Multiple-Output (MIMO) Agenda
SHARKFEST '09 | Stanford University | June 15–18, 2009 Creating a WLAN profile 1. Click ‚Edit‘ and ‚Configuration profiles‘ 3. Verify selected Profile 2. Select ‚New‘ and enter name +
SHARKFEST '09 | Stanford University | June 15–18, 2009 The Wireless Toolbar
SHARKFEST '09 | Stanford University | June 15–18, 2009 802.11 Channel number The Wireless Toolbar • Channel number can be changed during capturing
SHARKFEST '09 | Stanford University | June 15–18, 2009 Show frames with or without FCS errors Decryption in Wireshark or in Driver The Wireless Toolbar
SHARKFEST '09 | Stanford University | June 15–18, 2009 USBWireshark AirPcap Adapter 1 USB Driver AirPcap Driver Decryption Capture Filter Decryption Display Filter Decryption Modes • None: no decryption - use if packets are not encrypted or if key is not available • Wireshark: decryption in Wireshark – use in combination with display filtering • Driver: decryption in AirPcap driver – use in combination with capture filtering only
SHARKFEST '09 | Stanford University | June 15–18, 2009 The Wireless Toolbar Include Radio header to allow filtering on channel numbers
SHARKFEST '09 | Stanford University | June 15–18, 2009 The Wireless Toolbar
SHARKFEST '09 | Stanford University | June 15–18, 2009 • WEP Key formats: Keys light * 5 ASCII Character 5x8bit = 40 + 24 bit IV = 64 bit Key 1234ABCDEF 10 HEX Character 10x4bit = 40 + 24 bit IV = 64 bit Key lightningstar * 13 ASCII Character 13x8bit = 104 + 24 bit IV = 128 bit Key 123456..ABCDEF 26 HEX Character 26x4bit = 104 + 24 bit IV = 128 bit Key Decryption Keys • Wireshark supports decryption of WEP, WPA1 and WPA2 with static shared keys: * Wireshark does not support text entries for WEP keys, use a Text-to-HEX converter like www.swingnote.com/tools/texttohex.php
SHARKFEST '09 | Stanford University | June 15–18, 2009 Decryption Keys • Some clients (like Windows XP or VISTA) allow WEP key entries in text (ASCII) format
SHARKFEST '09 | Stanford University | June 15–18, 2009 • WPA-PWD (Password) Key SSID thisismypassword LNSWLAN 8 to 63 ASCII character password and SSID • WPA-PSK (Pre-shared-key) 1234567890ABCDEF1234567890ABCDEF1234567890ABCDEF1234567890ABCDEF exact 64 long HEX character string Decryption Keys
SHARKFEST '09 | Stanford University | June 15–18, 2009 Decryption Keys
SHARKFEST '09 | Stanford University | June 15–18, 2009 Decryption Keys • In order to decrypt WPA, you also need to capture the key negotiation process during connection setup
SHARKFEST '09 | Stanford University | June 15–18, 2009 Tuning display for WLAN Add new columns
SHARKFEST '09 | Stanford University | June 15–18, 2009 Tuning display for WLAN added columns
SHARKFEST '09 | Stanford University | June 15–18, 2009 Tuning display for WLAN Adding new colors
SHARKFEST '09 | Stanford University | June 15–18, 2009 Tuning display for WLAN Different color per channel
SHARKFEST '09 | Stanford University | June 15–18, 2009 Tuning display for WLAN Different color per frame type
SHARKFEST '09 | Stanford University | June 15–18, 2009 2400 2410 2420 2430 2440 2450 2460 2470 2480 2490 Mhz Channel 6 2426 2437 2448 Channel 11 2451 2462 2473 Channel 2 2406 2417 2428 Channel 7 2431 2442 2452 Channel 12 2456 2467 2478 Channel 3 2411 2422 2433 Channel 8 2436 2447 2458 Channel 13 2461 2472 2483 Channel 4 2416 2427 2438 Channel 9 2441 2452 2463 Channel 14 2473 2484 2495 Channel 5 2421 2432 2443 Channel 10 2446 2457 2468 Channel 1 2401 2412 2423 Allowed Channels: Ch1 - Ch11 USA (FCC) Ch1 - Ch13 Europe (ETSI) Ch1 - Ch14 Japan 802.11b/g Channel Allocation
SHARKFEST '09 | Stanford University | June 15–18, 2009 802.11b/g Channel Allocation Recorded with WiSpy
SHARKFEST '09 | Stanford University | June 15–18, 2009 WLAN Management Frames • Beacon • Probe request and response • Authentication • Deauthentication • Association request and response • Reassociation request and response • Disassociation These frames are used to establish and maintain communications within a single radio cell (channel)
SHARKFEST '09 | Stanford University | June 15–18, 2009 WLAN Control & Data Frames Control Frames • Request to Send (RTS) • Clear to Send (CTS) • Acknowledge • Power Save Poll These frames control the access to the shared media Data Frames • Data • Null Function These frames transport data or are use for keep alives
SHARKFEST '09 | Stanford University | June 15–18, 2009 WLAN Management Frames Beacon • Marks the presence of an Access Point (AP) • Sent 10 times / seconds (default) • Carries BSSID, MAC address etc. of AP • Indicates capabilities of AP (speeds etc.) • Indicates type and need for encryption • Keeps mobile clients time synchronized • Carries optional vendor specific info • and much more
SHARKFEST '09 | Stanford University | June 15–18, 2009 WLAN Management Frames Probe Request / Response • Purpose is to find an Access Point • Probe Request are always sent by client • Probe Requests are sent in all channels • Access Point replies with Probe Response • Probe Response contains same info fields like Beacon Remark: In „Passive Mode‟ no Probe Request are sent by the client, channels are scanned for Beacons (saves power)
SHARKFEST '09 | Stanford University | June 15–18, 2009 WLAN Management Frames Authentication • Initially two methods definded: – „Open Authentication‟ – „Shared Key Authentication‟ • Obsolete methods (unsecure) • 802.1x Authentication„ is mostly used today Deauthentication • Sent if a station or the Access Point wishes to terminate secure communications
SHARKFEST '09 | Stanford University | June 15–18, 2009 WLAN Management Frames Association Request • A station is applying to be registered with an Access point • A single station can only be associated with one Access Point Association Response • Reply from AP to confirm association Dissassociation • Sent to release an association
SHARKFEST '09 | Stanford University | June 15–18, 2009 WLAN Management Frames Reassociation Request • Sent by a roaming station to the new Access Point • Station lists the present Access Point in the Request as a reference Reassociation Response • Reply from the Access Point to confirm new association
SHARKFEST '09 | Stanford University | June 15–18, 2009 WLAN Control Frames Request to Send (RTS) • Sent by a station or Access Point to reserve a time slot for transmission • Used after a number of not acknowledged transmissions • Used in mixed b/g/n cells and hidden node situations to prevent collisions Clear to Send (CTS) • Reply to confirm the requested time slot
SHARKFEST '09 | Stanford University | June 15–18, 2009 WLAN Control Frames Acknowledge • Sent by a station or Access Point to confirm successful reception of a packet Power Save Poll • Sent by a station in sleep mode to fetch packets stored in Access Point
SHARKFEST '09 | Stanford University | June 15–18, 2009 WLAN Data Frames Data • Data frames may be encrypted or in clear text • Data frames may contain 802.11 QOS control for Voice over WLAN Null Function • Data frame containing no data • Used for keep-alives or signaling power save condition
SHARKFEST '09 | Stanford University | June 15–18, 2009 APSta2 Sta1 MAC Sta2 MAC Sta1 SADA Type PDU MAC AP MAC Sta1 MAC Sta2 Seq.FC Dur. PDU BSS ID SA DA To Distribution System Ethernet Frame AP Sta2 MAC Sta1 MAC Sta2 SADA Type PDU Sta1 MAC Sta1 MAC AP MAC Sta2 Seq.FC Dur. PDU DA BSS ID SA From Distribution System Ethernet Frame WLAN Frame Formats +
SHARKFEST '09 | Stanford University | June 15–18, 2009 WLAN Frame Formats FCFC Dur. RA TA Request to Send FCFC Dur. RA Acknowledge, Clear to Send Data Frame through repeaterSeq.FC Dur. PDUSADATARA Seq.FC Dur. PDUDA/SARA TA Data Frame, Beacon, Probe Request, Probe Response, Authentication, Deauthentication, Association, Reassociation, Disassociation FC = Frame Control, Dur. = Duration, RA = Receiver Address, TA = Transmitter Address; DA = Destination Address, SA = Source Address, Seq. = Sequence, PDU = Protocol Data Unit, FC = Frame Check Sequence +
SHARKFEST '09 | Stanford University | June 15–18, 2009 Client can not associate - Case one
SHARKFEST '09 | Stanford University | June 15–18, 2009 Client can not associate - Case one
SHARKFEST '09 | Stanford University | June 15–18, 2009 Client can not associate - Case two
SHARKFEST '09 | Stanford University | June 15–18, 2009 USB NIC Driver Protocol Driver: TCP/IP Capture Driver: WinPcap Windows Applications Wireshark Browser Mail Office WLAN (NIC) AirPcap Adapter 1 USB Driver AirPcap Adapter 2 AirPcap Adapter 3 Analyzing Roaming Problems • Multiple AirPcap adapters can be combined in one logical I/F • Data from selected channels will be captured in one trace file Channel 1 Channel 6 Channel 11
SHARKFEST '09 | Stanford University | June 15–18, 2009 Analyzing Roaming Problems • Roaming problems are quite complex to analyze • In order to capture the roaming event, you have to follow the roaming client as close as possible • Set a display filter to BEACONs and MAC address of roaming client • Mounting USB hub and AirPcap adapters on a notebook gives you a mobile solution to capture roaming processes
SHARKFEST '09 | Stanford University | June 15–18, 2009 Combining multiple Airpcap adapters • More than one AirPcap adapter will be automatically combined in the AirPcap Multi-Channel Aggregator • Channel numbers must be configured individually on each adapter
SHARKFEST '09 | Stanford University | June 15–18, 2009 Roaming Client
SHARKFEST '09 | Stanford University | June 15–18, 2009 Throughput Analysis • Throughput will always be an issue in WLANs • A radio cell is a shared media with half duplex conversation • Indicated throughput (i.e. 54Mbps) are maximum values and are only achieved under optimal conditions • Data throughput is around 50% of cell throughput • Presence of old 802.11b-only client will reduce cell throughput significantly
SHARKFEST '09 | Stanford University | June 15–18, 2009 CCK = Complementary Code Keying DBPSK = Differential Binary Phase-Shift Keying DQPSK = Differential Quadrature Phase-Shift Keying OFDM = Orthogonal Frequency Division Multiplexing Mbps 1 2 5.5 11 6, 9 12, 18 24, 36 48, 54 7.2-72.2 14.4-144.4 Coding Barker Barker CCK CCK OFDM OFDM OFDM OFDM OFDM OFDM Description 802.11 DSSS (Clause 15) with ‚Long Preamble‘ 802.11g Extended Rate PHY (ERP) 802.11b HR/DSSS (Clause 18) with ‚Short Preamble‘ 802.11a DBPSK DQPSK Modulation BPSK QPSK 16-QAM 64-QAM MCS 0-7 MCS 8-15 BPSK = Binary Phase-Shift Keying QPSK = Quadrature Phase-Shift Keying QAM = Quadrature Amplitude Modul. MCS = Modulation Coding Scheme 1 Stream 2 Streams 802.11n High Throughput (HT) Extensions 2.4 GHz 5 GHz Overview WLAN Standards 802.11n (HT) Extensions
SHARKFEST '09 | Stanford University | June 15–18, 2009 802.11 DSSS with ‚Long Preamble‘ Barker Code 802.11n (HT) High Throughput extended OFDM 802.11b HR/DSSS with ‚Short Preamble‘ Barker / CCK SFDPreamble 128 16 48 Header 1 Mbps Bits MAC Header 1-2 Mbps SFDPreamble 56 16 48 Header 1 Mbps Bits MAC Header Data 5.5 -11 Mbps2 Mbps Preamble 96 24 Header Bits MAC Header Data 7.2-72.2 Mbps7.2Mbps PLCP PLCP = Physical Layer Convergence Protocol MPDU = MAC Layer Protocol Data Unit MPDU Data 802.11g (ERP) Extended Rate PHY OFDM Preamble 96 24 Header Bits MAC Header Data 6-54 Mbps6 Mbps Overview Frame Types (2.4 GHz)
SHARKFEST '09 | Stanford University | June 15–18, 2009 Throughput Analysis
SHARKFEST '09 | Stanford University | June 15–18, 2009 OFDM (ERP) stations are sending control frames ‚Clear-to send to self‘ (CTS-to-self) before each data frame to reserve time slot Throughput Analysis
SHARKFEST '09 | Stanford University | June 15–18, 2009 Source: Cisco Systems Throughput improvement: Upgrade of all 802.11b stations to 802.11g Throughput Analysis • Reduced data throughput in mixed environment
SHARKFEST '09 | Stanford University | June 15–18, 2009 Some channels only allowed for inhouse use *New stricter FCC DFS2 rules valid off July 20, 2007 Channel Allocation 5 GHz Band
SHARKFEST '09 | Stanford University | June 15–18, 2009 • 802.11n introduces lots of new WLAN technologies • Physical layer improvements with new ODFM • MIMO supports multiple streams within one channel • Channel bonding combines two adjacent channels • Frame aggregation allows large frames or streaming packets • Block acknowledges replaces ping pong procedure • With two streams and two channels up to 300 Mbps • Future product will support four streams and up to 600 Mbps Multiple-Input, Multiple-Output (MIMO)
SHARKFEST '09 | Stanford University | June 15–18, 2009 Reflecting Object 2 Transmitters 3 Receivers Reflecting Object Multiple Streams (Spatial Multiplexing) • A signal stream is broken down into multiple signal streams, each is transmitted from a different antenna. • Each of these “spatial” streams arrives at the receiver with different amplitude (signal strength) and phase. +
SHARKFEST '09 | Stanford University | June 15–18, 2009 Channel 6 Channel 10 Channel Bonding 2.4 GHz Band
SHARKFEST '09 | Stanford University | June 15–18, 2009 Channel 52 Channel 56 Channel Bonding 5 GHz Band
SHARKFEST '09 | Stanford University | June 15–18, 2009 All trace files made with:  Wireshark Version 0.99.8 (SVN Rev 24492)  Cisco AIR-AP1252AG-E-K9; S/W 12.4(10b)JA  Buffalo WLI-CG-AG300N; Driver 3.0.0.13 Aggregate-MAC Service Data Unit (A-MSDU)
SHARKFEST '09 | Stanford University | June 15–18, 2009 Aggregate-MAC Protocol Data Unit (A-MPDU)
SHARKFEST '09 | Stanford University | June 15–18, 2009 Block Acknowledges
SHARKFEST '09 | Stanford University | June 15–18, 2009 150Mbps A-MPDUs Total rate Reassembled Frames Block Acknowledges UDP bandwidth measurement with IPerf indicates throughput of 126Mbps 802.11n Throughput analysis
SHARKFEST '09 | Stanford University | June 15–18, 2009 Thank you for your attention Please fill in the evals Trace files are available on request from: Rolf Leutert Leutert NetServices leutert@wireshark.ch © SeaPics.com

More Related Content

Using WireShark with AirPCAP

  • 1. SHARKFEST '09 | Stanford University | June 15–18, 2009 Analyzing WLANs with Wireshark & AirPcap Sessions BU-5 Rolf Leutert Consultant & Trainer | Leutert NetServices, Switzerland SHARKFEST '09 Stanford University June 15-18, 2009
  • 2. SHARKFEST '09 | Stanford University | June 15–18, 2009 • Setting up Wireshark with AirPcap • Capturing WLAN data • WLAN Management, Control & Data Frames • WLAN Frame Formats • Analyzing: Client can not associate • Analyzing: Roaming problems • Analyzing: Throughput issues • Multiple-Input, Multiple-Output (MIMO) Agenda
  • 3. SHARKFEST '09 | Stanford University | June 15–18, 2009 Creating a WLAN profile 1. Click ‚Edit‘ and ‚Configuration profiles‘ 3. Verify selected Profile 2. Select ‚New‘ and enter name +
  • 4. SHARKFEST '09 | Stanford University | June 15–18, 2009 The Wireless Toolbar
  • 5. SHARKFEST '09 | Stanford University | June 15–18, 2009 802.11 Channel number The Wireless Toolbar • Channel number can be changed during capturing
  • 6. SHARKFEST '09 | Stanford University | June 15–18, 2009 Show frames with or without FCS errors Decryption in Wireshark or in Driver The Wireless Toolbar
  • 7. SHARKFEST '09 | Stanford University | June 15–18, 2009 USBWireshark AirPcap Adapter 1 USB Driver AirPcap Driver Decryption Capture Filter Decryption Display Filter Decryption Modes • None: no decryption - use if packets are not encrypted or if key is not available • Wireshark: decryption in Wireshark – use in combination with display filtering • Driver: decryption in AirPcap driver – use in combination with capture filtering only
  • 8. SHARKFEST '09 | Stanford University | June 15–18, 2009 The Wireless Toolbar Include Radio header to allow filtering on channel numbers
  • 9. SHARKFEST '09 | Stanford University | June 15–18, 2009 The Wireless Toolbar
  • 10. SHARKFEST '09 | Stanford University | June 15–18, 2009 • WEP Key formats: Keys light * 5 ASCII Character 5x8bit = 40 + 24 bit IV = 64 bit Key 1234ABCDEF 10 HEX Character 10x4bit = 40 + 24 bit IV = 64 bit Key lightningstar * 13 ASCII Character 13x8bit = 104 + 24 bit IV = 128 bit Key 123456..ABCDEF 26 HEX Character 26x4bit = 104 + 24 bit IV = 128 bit Key Decryption Keys • Wireshark supports decryption of WEP, WPA1 and WPA2 with static shared keys: * Wireshark does not support text entries for WEP keys, use a Text-to-HEX converter like www.swingnote.com/tools/texttohex.php
  • 11. SHARKFEST '09 | Stanford University | June 15–18, 2009 Decryption Keys • Some clients (like Windows XP or VISTA) allow WEP key entries in text (ASCII) format
  • 12. SHARKFEST '09 | Stanford University | June 15–18, 2009 • WPA-PWD (Password) Key SSID thisismypassword LNSWLAN 8 to 63 ASCII character password and SSID • WPA-PSK (Pre-shared-key) 1234567890ABCDEF1234567890ABCDEF1234567890ABCDEF1234567890ABCDEF exact 64 long HEX character string Decryption Keys
  • 13. SHARKFEST '09 | Stanford University | June 15–18, 2009 Decryption Keys
  • 14. SHARKFEST '09 | Stanford University | June 15–18, 2009 Decryption Keys • In order to decrypt WPA, you also need to capture the key negotiation process during connection setup
  • 15. SHARKFEST '09 | Stanford University | June 15–18, 2009 Tuning display for WLAN Add new columns
  • 16. SHARKFEST '09 | Stanford University | June 15–18, 2009 Tuning display for WLAN added columns
  • 17. SHARKFEST '09 | Stanford University | June 15–18, 2009 Tuning display for WLAN Adding new colors
  • 18. SHARKFEST '09 | Stanford University | June 15–18, 2009 Tuning display for WLAN Different color per channel
  • 19. SHARKFEST '09 | Stanford University | June 15–18, 2009 Tuning display for WLAN Different color per frame type
  • 20. SHARKFEST '09 | Stanford University | June 15–18, 2009 2400 2410 2420 2430 2440 2450 2460 2470 2480 2490 Mhz Channel 6 2426 2437 2448 Channel 11 2451 2462 2473 Channel 2 2406 2417 2428 Channel 7 2431 2442 2452 Channel 12 2456 2467 2478 Channel 3 2411 2422 2433 Channel 8 2436 2447 2458 Channel 13 2461 2472 2483 Channel 4 2416 2427 2438 Channel 9 2441 2452 2463 Channel 14 2473 2484 2495 Channel 5 2421 2432 2443 Channel 10 2446 2457 2468 Channel 1 2401 2412 2423 Allowed Channels: Ch1 - Ch11 USA (FCC) Ch1 - Ch13 Europe (ETSI) Ch1 - Ch14 Japan 802.11b/g Channel Allocation
  • 21. SHARKFEST '09 | Stanford University | June 15–18, 2009 802.11b/g Channel Allocation Recorded with WiSpy
  • 22. SHARKFEST '09 | Stanford University | June 15–18, 2009 WLAN Management Frames • Beacon • Probe request and response • Authentication • Deauthentication • Association request and response • Reassociation request and response • Disassociation These frames are used to establish and maintain communications within a single radio cell (channel)
  • 23. SHARKFEST '09 | Stanford University | June 15–18, 2009 WLAN Control & Data Frames Control Frames • Request to Send (RTS) • Clear to Send (CTS) • Acknowledge • Power Save Poll These frames control the access to the shared media Data Frames • Data • Null Function These frames transport data or are use for keep alives
  • 24. SHARKFEST '09 | Stanford University | June 15–18, 2009 WLAN Management Frames Beacon • Marks the presence of an Access Point (AP) • Sent 10 times / seconds (default) • Carries BSSID, MAC address etc. of AP • Indicates capabilities of AP (speeds etc.) • Indicates type and need for encryption • Keeps mobile clients time synchronized • Carries optional vendor specific info • and much more
  • 25. SHARKFEST '09 | Stanford University | June 15–18, 2009 WLAN Management Frames Probe Request / Response • Purpose is to find an Access Point • Probe Request are always sent by client • Probe Requests are sent in all channels • Access Point replies with Probe Response • Probe Response contains same info fields like Beacon Remark: In „Passive Mode‟ no Probe Request are sent by the client, channels are scanned for Beacons (saves power)
  • 26. SHARKFEST '09 | Stanford University | June 15–18, 2009 WLAN Management Frames Authentication • Initially two methods definded: – „Open Authentication‟ – „Shared Key Authentication‟ • Obsolete methods (unsecure) • 802.1x Authentication„ is mostly used today Deauthentication • Sent if a station or the Access Point wishes to terminate secure communications
  • 27. SHARKFEST '09 | Stanford University | June 15–18, 2009 WLAN Management Frames Association Request • A station is applying to be registered with an Access point • A single station can only be associated with one Access Point Association Response • Reply from AP to confirm association Dissassociation • Sent to release an association
  • 28. SHARKFEST '09 | Stanford University | June 15–18, 2009 WLAN Management Frames Reassociation Request • Sent by a roaming station to the new Access Point • Station lists the present Access Point in the Request as a reference Reassociation Response • Reply from the Access Point to confirm new association
  • 29. SHARKFEST '09 | Stanford University | June 15–18, 2009 WLAN Control Frames Request to Send (RTS) • Sent by a station or Access Point to reserve a time slot for transmission • Used after a number of not acknowledged transmissions • Used in mixed b/g/n cells and hidden node situations to prevent collisions Clear to Send (CTS) • Reply to confirm the requested time slot
  • 30. SHARKFEST '09 | Stanford University | June 15–18, 2009 WLAN Control Frames Acknowledge • Sent by a station or Access Point to confirm successful reception of a packet Power Save Poll • Sent by a station in sleep mode to fetch packets stored in Access Point
  • 31. SHARKFEST '09 | Stanford University | June 15–18, 2009 WLAN Data Frames Data • Data frames may be encrypted or in clear text • Data frames may contain 802.11 QOS control for Voice over WLAN Null Function • Data frame containing no data • Used for keep-alives or signaling power save condition
  • 32. SHARKFEST '09 | Stanford University | June 15–18, 2009 APSta2 Sta1 MAC Sta2 MAC Sta1 SADA Type PDU MAC AP MAC Sta1 MAC Sta2 Seq.FC Dur. PDU BSS ID SA DA To Distribution System Ethernet Frame AP Sta2 MAC Sta1 MAC Sta2 SADA Type PDU Sta1 MAC Sta1 MAC AP MAC Sta2 Seq.FC Dur. PDU DA BSS ID SA From Distribution System Ethernet Frame WLAN Frame Formats +
  • 33. SHARKFEST '09 | Stanford University | June 15–18, 2009 WLAN Frame Formats FCFC Dur. RA TA Request to Send FCFC Dur. RA Acknowledge, Clear to Send Data Frame through repeaterSeq.FC Dur. PDUSADATARA Seq.FC Dur. PDUDA/SARA TA Data Frame, Beacon, Probe Request, Probe Response, Authentication, Deauthentication, Association, Reassociation, Disassociation FC = Frame Control, Dur. = Duration, RA = Receiver Address, TA = Transmitter Address; DA = Destination Address, SA = Source Address, Seq. = Sequence, PDU = Protocol Data Unit, FC = Frame Check Sequence +
  • 34. SHARKFEST '09 | Stanford University | June 15–18, 2009 Client can not associate - Case one
  • 35. SHARKFEST '09 | Stanford University | June 15–18, 2009 Client can not associate - Case one
  • 36. SHARKFEST '09 | Stanford University | June 15–18, 2009 Client can not associate - Case two
  • 37. SHARKFEST '09 | Stanford University | June 15–18, 2009 USB NIC Driver Protocol Driver: TCP/IP Capture Driver: WinPcap Windows Applications Wireshark Browser Mail Office WLAN (NIC) AirPcap Adapter 1 USB Driver AirPcap Adapter 2 AirPcap Adapter 3 Analyzing Roaming Problems • Multiple AirPcap adapters can be combined in one logical I/F • Data from selected channels will be captured in one trace file Channel 1 Channel 6 Channel 11
  • 38. SHARKFEST '09 | Stanford University | June 15–18, 2009 Analyzing Roaming Problems • Roaming problems are quite complex to analyze • In order to capture the roaming event, you have to follow the roaming client as close as possible • Set a display filter to BEACONs and MAC address of roaming client • Mounting USB hub and AirPcap adapters on a notebook gives you a mobile solution to capture roaming processes
  • 39. SHARKFEST '09 | Stanford University | June 15–18, 2009 Combining multiple Airpcap adapters • More than one AirPcap adapter will be automatically combined in the AirPcap Multi-Channel Aggregator • Channel numbers must be configured individually on each adapter
  • 40. SHARKFEST '09 | Stanford University | June 15–18, 2009 Roaming Client
  • 41. SHARKFEST '09 | Stanford University | June 15–18, 2009 Throughput Analysis • Throughput will always be an issue in WLANs • A radio cell is a shared media with half duplex conversation • Indicated throughput (i.e. 54Mbps) are maximum values and are only achieved under optimal conditions • Data throughput is around 50% of cell throughput • Presence of old 802.11b-only client will reduce cell throughput significantly
  • 42. SHARKFEST '09 | Stanford University | June 15–18, 2009 CCK = Complementary Code Keying DBPSK = Differential Binary Phase-Shift Keying DQPSK = Differential Quadrature Phase-Shift Keying OFDM = Orthogonal Frequency Division Multiplexing Mbps 1 2 5.5 11 6, 9 12, 18 24, 36 48, 54 7.2-72.2 14.4-144.4 Coding Barker Barker CCK CCK OFDM OFDM OFDM OFDM OFDM OFDM Description 802.11 DSSS (Clause 15) with ‚Long Preamble‘ 802.11g Extended Rate PHY (ERP) 802.11b HR/DSSS (Clause 18) with ‚Short Preamble‘ 802.11a DBPSK DQPSK Modulation BPSK QPSK 16-QAM 64-QAM MCS 0-7 MCS 8-15 BPSK = Binary Phase-Shift Keying QPSK = Quadrature Phase-Shift Keying QAM = Quadrature Amplitude Modul. MCS = Modulation Coding Scheme 1 Stream 2 Streams 802.11n High Throughput (HT) Extensions 2.4 GHz 5 GHz Overview WLAN Standards 802.11n (HT) Extensions
  • 43. SHARKFEST '09 | Stanford University | June 15–18, 2009 802.11 DSSS with ‚Long Preamble‘ Barker Code 802.11n (HT) High Throughput extended OFDM 802.11b HR/DSSS with ‚Short Preamble‘ Barker / CCK SFDPreamble 128 16 48 Header 1 Mbps Bits MAC Header 1-2 Mbps SFDPreamble 56 16 48 Header 1 Mbps Bits MAC Header Data 5.5 -11 Mbps2 Mbps Preamble 96 24 Header Bits MAC Header Data 7.2-72.2 Mbps7.2Mbps PLCP PLCP = Physical Layer Convergence Protocol MPDU = MAC Layer Protocol Data Unit MPDU Data 802.11g (ERP) Extended Rate PHY OFDM Preamble 96 24 Header Bits MAC Header Data 6-54 Mbps6 Mbps Overview Frame Types (2.4 GHz)
  • 44. SHARKFEST '09 | Stanford University | June 15–18, 2009 Throughput Analysis
  • 45. SHARKFEST '09 | Stanford University | June 15–18, 2009 OFDM (ERP) stations are sending control frames ‚Clear-to send to self‘ (CTS-to-self) before each data frame to reserve time slot Throughput Analysis
  • 46. SHARKFEST '09 | Stanford University | June 15–18, 2009 Source: Cisco Systems Throughput improvement: Upgrade of all 802.11b stations to 802.11g Throughput Analysis • Reduced data throughput in mixed environment
  • 47. SHARKFEST '09 | Stanford University | June 15–18, 2009 Some channels only allowed for inhouse use *New stricter FCC DFS2 rules valid off July 20, 2007 Channel Allocation 5 GHz Band
  • 48. SHARKFEST '09 | Stanford University | June 15–18, 2009 • 802.11n introduces lots of new WLAN technologies • Physical layer improvements with new ODFM • MIMO supports multiple streams within one channel • Channel bonding combines two adjacent channels • Frame aggregation allows large frames or streaming packets • Block acknowledges replaces ping pong procedure • With two streams and two channels up to 300 Mbps • Future product will support four streams and up to 600 Mbps Multiple-Input, Multiple-Output (MIMO)
  • 49. SHARKFEST '09 | Stanford University | June 15–18, 2009 Reflecting Object 2 Transmitters 3 Receivers Reflecting Object Multiple Streams (Spatial Multiplexing) • A signal stream is broken down into multiple signal streams, each is transmitted from a different antenna. • Each of these “spatial” streams arrives at the receiver with different amplitude (signal strength) and phase. +
  • 50. SHARKFEST '09 | Stanford University | June 15–18, 2009 Channel 6 Channel 10 Channel Bonding 2.4 GHz Band
  • 51. SHARKFEST '09 | Stanford University | June 15–18, 2009 Channel 52 Channel 56 Channel Bonding 5 GHz Band
  • 52. SHARKFEST '09 | Stanford University | June 15–18, 2009 All trace files made with:  Wireshark Version 0.99.8 (SVN Rev 24492)  Cisco AIR-AP1252AG-E-K9; S/W 12.4(10b)JA  Buffalo WLI-CG-AG300N; Driver 3.0.0.13 Aggregate-MAC Service Data Unit (A-MSDU)
  • 53. SHARKFEST '09 | Stanford University | June 15–18, 2009 Aggregate-MAC Protocol Data Unit (A-MPDU)
  • 54. SHARKFEST '09 | Stanford University | June 15–18, 2009 Block Acknowledges
  • 55. SHARKFEST '09 | Stanford University | June 15–18, 2009 150Mbps A-MPDUs Total rate Reassembled Frames Block Acknowledges UDP bandwidth measurement with IPerf indicates throughput of 126Mbps 802.11n Throughput analysis
  • 56. SHARKFEST '09 | Stanford University | June 15–18, 2009 Thank you for your attention Please fill in the evals Trace files are available on request from: Rolf Leutert Leutert NetServices leutert@wireshark.ch © SeaPics.com