Wireshark Plugin To Capture Wireless Frames Using a WLANPi (Windows 10)

-
Want to be able to capture wireless frames via a WLANPi using just Wireshark on your Windows 10 machine? ...And be able to configure the capture configuration on the WLANPi using just Wireshark too?  Read on... (or checkout the video here)



Earlier this year, I put out a command-line script called WLANPiShark that allowed Windows 10 users to configure a WLANPi and initiate a frame capture stream in to Wireshark. Though a little clunky, it worked quite reliably for most of the time and, judging by feedback I received, was quite popular.

As Windows users, we've always been the poor cousins to our Apple brethren who are able to use their Macbook to capture over the air using the internal NIC card of their Mac in monitor mode. Getting a low cost adapter that could be put in to monitor mode on a Windows machine was as rare as hen's teeth.

Having access to the WLANPi and being able to fire up WLANPiShark opened up wireless capturing to many folks who have to use Windows machines, but were unable to easily get a wireless capture (without investing in some quite expensive tools).

With the arrival of Wireshark 3.0.x, new options became available that allow us even better ways to capture in Windows using a WLANPi. SSHDump was a newly introduced package that allows a easy method of initiating an SSH session in to a remote device and firing up commands to initiate a tcpdump capture stream (in a far less clunky way that we did in WLANPiShark).

Adrian Granados kicked off a project called wlan-extcap on GitHub, based on a Python script, that leveraged the new SSHDump Wireshark package via a plugin that he created. It also added new functions directly it to the Wireshark GUI to allow configuration of a WLANPi (...yes, the guy's a genius coder!). The project was primarily aimed at Mac users, but could potentially be used by Windows users if they installed Python on their Windows machine.

Inspired by his amazing work on his project, I decided to take the principles of his project and write a similar utility written in native Windows batch-file format. This would allow Windows users to simply copy a batch file in to their Wireshark directory to obtain the same functions as Adrian's plugin and not have to worry about adding any supporting software packages.

The result is my own project called: wlan-extcap-win

Rather than documenting the plugin on my blog, I have created a fairly lengthy ReadMe on the GitHub site where the script has been developed so that you can download the script and give it a try.

I hope you find this just as much fun as WLANPiShark and even easier and more convenient to use.

References



Popular posts from this blog

The 5GHz “Problem” For Wi-Fi Networks: DFS

-
Image
Wi-Fi networking provides us with 2 bands for the operation of wireless LAN networks: the 2.4Ghz band and the 5GHz band. The 2.4GHz band has a reputation of being something of a “sewer” of a band, due to its limited number of usable channels, the number of Wi-Fi devices already using the band, and the high levels of non-Wi-Fi interference that it experiences. Many wireless LAN professionals will generally advise that you put your “important stuff” on the 5GHz band whenever possible. 5GHz has far more channels available, a corresponding lower number of devices per channel, and generally suffers much lower non-Wi-Fi interference. However, beneath the headline of “2.4Ghz = bad, 5Ghz = good”, there lurks a shadowy figure that can be troublesome if you’re not aware of its potential impact: DFS. Background Wi-Fi networks operate in areas of RF spectrum that require no licence to operate. This is in contrast to many other areas of the radio spectrum that generally require some form of (p
Read more

What Are Sticky Clients?

-
Image
One term you'll often hear banded about when talking with Wi-Fi professionals is "sticky clients". I thought it might be worth spending a few moments exploring what is meant by "sticky clients", why they are generally considered to be a bad thing in Wi-Fi networks and some approaches to mitigate them. Background Many folks dealing with Wi-Fi networks often talk about the "sticky" characteristics of wireless clients when discussing client roaming within a W-iFi network. In an ideal world, we'd like to have access points providing ubiquitous coverage across our desired area providing high-quality, consistent client coverage where-ever we go. In this wonderful land of rainbows and unicorns, our clients would gracefully roam from AP to AP, detecting and associating with their closest AP throughout the coverage area to ensure their best connection speed at all times. Unfortunately, the real world doesn’t quite reflect this roaming-client
Read more

Microsoft NPS as a RADIUS Server for WiFi Networks: SSID Filtering

-
Image
The Microsoft Network Policy Server (NPS) is often used as a  RADIUS server for WiFi networks. It can provide authentication and authorization services for devices and users on a wireless network in a Windows Active Directory environment. In this article we look at how we can use NPS to provide authentication for WiFi users across a number of SSIDs. We have previously discussed how to authenticate groups of users using the same SSID and then assign them to a VLAN that is appropriate to their security authorization. However, there may still be instances where two or more SSIDs are in-use on a wireless network and we would like to base policy decisions on the SSID that the authentication request is being generated from. As an example, if we consider a school, perhaps we would like students to only be able to authenticate if they connected to the SSID: "Student_Net". Similarly,  staff should only be able to connect using the SSID: "Staff_Net". This would
Read more