WifiNigel

I've been doing some study for my CWAP  (wireless analysis) exam recently, so I've been spending quite some time staring at Wirehsark traces trying to figure out precisely what all of those 802.11 fields actually mean. One thing I noticed whilst pouring over a few capture files is that some of them seemed to have some additional fields included in the trace, which seem to have nothing to do with fields defined in 802.11 frames at all. They are in a section of the packet decode called 'RadioTap Headers'. I wasn't too sure what they were and why they are available in some captures, whilst in others they were missing. After a little bit of research, I found out a bit more information and thought it might be worth sharing in a quick blog post. In summary, radiotap headers provide additional information that is added to each 802.11 frame when capturing frames with an analysis application. Just to be clear, these are not part of the standard 802.11 frame form...

I was recently reading through the most recent edition the finest WiFi text book in the world (in my opinion): the CWNA study guide . I read the previous versions a couple of times when I took my original CWNA exam and subsequent renewals. Looking through the latest book, I've picked up a a few nuggets which I either missed, or weren't included in the previous versions that I read. I had one "light bulb" moment when reading about antenna radiation patterns.  If you've ever looked at datasheets for antennas or access points, you may well have come across diagrams (like those shown below) that show the radiation pattern of an antenna. Fig1 - Antenna Azimuth Chart Fig2 - Antenna Elevation Chart There are generally two types of radiation pattern shown for each antenna: Azimuth (i.e. the RF radiation pattern when viewed from above the antenna) Elevation (i.e. a side-on view of the antenna RF radiation pattern) These are useful to unders...

Occasionally you may come across an instance where you need to reset a Cisco 'lightweight' AP to it's default configuration. However, if the AP is not associated to a controller and you do not know the local username/password of the AP, then this can be something of a challenge. In summary, here are the steps to default the AP when you cannot get in to the AP via the 'usual' methods: Put a console cable in to the AP and fire up your terminal emulation program Power up the AP with the reset button pressed at the same time Release the reset button after 15 - 20 secs On the console, you should now be dropped in to a ' ap: ' prompt. Type in the following command to see the files on the AP: ' dir flash:' One of the files listed should be 'private-multiple-fs' Enter the following command to remove the configuration: delete flash:private-multiple-fs Reboot the AP - you will be able to login to the AP using the usual defaults (i.e. enable...