Thursday, 14 November 2019

Wireshark Showing FCS Fields as "Unverified" in Captures

In a recent Wireshark 3.0.6 capture I noticed that FCS values for captured wireless frames were showing as "Unverified". I wasn't sure why this was the case, as I'm sure that Wireshark usually shows a "good" or "bad"  FCS indication. The image below demonstrates what I saw:

After some googling, I found a note that the FCS check was disabled by defaut in Wireshark 3.0.x as some NICs report the FCS check incorrectly. 

The following process details how to re-enable the check: 

  • Go to Edit -> Preferences -> Advanced in Wireshark. Enter "wlan.check" in the search bar:


Double click on the "False" word for the attribute "wlan.check_checksum". This will toggle it to "True" (make sure you click on the "False" word, not anywhere else on the line). 


Hit OK and see the change immediately in your capture decode:


Hope this quick note may help someone in the future (...probably me when I've forgotten how I fixed this!)

References:


Sunday, 3 November 2019

Wireshark Plugin To Capture Wireless Frames Using a WLANPi (Windows 10)

Want to be able to capture wireless frames via a WLANPi using just Wireshark on your Windows 10 machine? ...And be able to configure the capture configuration on the WLANPi using just Wireshark too?  Read on... (or checkout the video here)



Earlier this year, I put out a command-line script called WLANPiShark that allowed Windows 10 users to configure a WLANPi and initiate a frame capture stream in to Wireshark. Though a little clunky, it worked quite reliably for most of the time and, judging by feedback I received, was quite popular.

As Windows users, we've always been the poor cousins to our Apple brethren who are able to use their Macbook to capture over the air using the internal NIC card of their Mac in monitor mode. Getting a low cost adapter that could be put in to monitor mode on a Windows machine was as rare as hen's teeth.

Having access to the WLANPi and being able to fire up WLANPiShark opened up wireless capturing to many folks who have to use Windows machines, but were unable to easily get a wireless capture (without investing in some quite expensive tools).

With the arrival of Wireshark 3.0.x, new options became available that allow us even better ways to capture in Windows using a WLANPi. SSHDump was a newly introduced package that allows a easy method of initiating an SSH session in to a remote device and firing up commands to initiate a tcpdump capture stream (in a far less clunky way that we did in WLANPiShark).

Adrian Granados kicked off a project called wlan-extcap on GitHub, based on a Python script, that leveraged the new SSHDump Wireshark package via a plugin that he created. It also added new functions directly it to the Wireshark GUI to allow configuration of a WLANPi (...yes, the guy's a genius coder!). The project was primarily aimed at Mac users, but could potentially be used by Windows users if they installed Python on their Windows machine.

Inspired by his amazing work on his project, I decided to take the principles of his project and write a similar utility written in native Windows batch-file format. This would allow Windows users to simply copy a batch file in to their Wireshark directory to obtain the same functions as Adrian's plugin and not have to worry about adding any supporting software packages.

The result is my own project called: wlan-extcap-win

Rather than documenting the plugin on my blog, I have created a fairly lengthy ReadMe on the GitHub site where the script has been developed so that you can download the script and give it a try.

I hope you find this just as much fun as WLANPiShark and even easier and more convenient to use.

References



Friday, 23 August 2019

Wireless Analysis Resources



Wireless traffic capture and analysis can be a tricky business and is often seen as something of a dark art to newcomers to the world of Wi-Fi. There are a huge variety of options when considering how to capture wireless traffic over the air, with many of the solutions being paid-for options that may be out of reach for many individuals.

Many people approaching wireless analysis may already be familiar with Wireshark, based on their previous experience on wired networks, where they may have used it for troubleshooting and analysis purposes.  They may wonder if they can use Wireshark for their initial foray into wireless analysis.  Using Wireshark for wireless capture and analysis on Wi-Fi networks can be a little tricky and presents the newcomer with a whole new slew of frame types to learn.

There are many good articles, videos and podcasts out there looking at wireless analysis, particularly if Wireshark is your tool of choice. I thought it would be good to pull them together in one place to make it easier for the newcomer to find the resources they may need. I've grouped together various resources below that will hopefully help those on their Wireshark/wireless analysis journey.

Please let me know if you have other resources that you find or have found useful yourself (wifinigel@gmail.com)

Wireless Capture:

Wireshark Customization:

Wireless Analysis Podcasts:

CWAP Study Notes:

Books:

Paid-for Online Training:

Online (Cloud) Capture Analysis Tools: