Lab Objective:
The objective of this lab is to learn how to use the WLAN Header Settings.
Lab Purpose:
Understand the WLAN Header Settings and why they are used. You will use this information as part of your troubleshooting. It’s hard to actually create faults in a lab for wireless.
Lab Tool:
Wireshark Network Analyzer on PC and Ethernet Switch/Router (cable/WiFi)
Lab Topology:
Please use the following topology to complete this lab exercise (Pc equipped with Wireshark connected via wireless to a Network Router that has access to the internet).
Lab Walkthrough:
Task 1
Start Wireshark and from the Main Window, click “Capture” and then “Options”. On a Wireless interface row, enable the monitor checkbox as displayed in the figure below, and capture some minutes of traffic. Stop, then capture and save the file.
The result in the Packet List pane will be similar to the one displayed in the figure below, where it is possible to verify that there are three types of 802.11 frames seen on WLANs:
Data: Contains data of some sort
Management: Used to establish MAC-layer connectivity. Association Request/Responses, Probe Requests/Responses, and Beacons are examples of management frames.
Control: Used to enable delivery of data and management frames; Request-to-Send (RTS) and Clear-to- Send (CTS) and ACKs are Control frames
The management and control frames are used to enable the basic 802.11 processes. Data frames are quite simply used to transfer data across the WLAN.
Select, for example, packet #5 from the Packet List pane (see the figure below where all the fields in the Packet Details pane are unpacked in the treeview). It is possible to identify it as a DATA frame. Data frames are the only WLAN frame types that can be forwarded to the wired network.
Although the IEEE 802.11 specifications state that the MAC Service Data Unit (MSDU) can be up to 2304 bytes. You will probably see smaller data frames as these frames are bridged to an Ethernet network (see in this example, the length of the data frame is equal to 213 bytes). For example, if a STA makes a connection to an HTTP server on the wired network, the Maximum Segment Size (MSS) will be negotiated during the TCP handshake process. This is the size of the TCP segment that will be prepended by the TCP and IP headers and encapsulated in an 802.11 header
Select another packet from the Packet List pane, and in particular, frame #8, as it is possible to identify it as a Management Frame. In this case, it is a Beacon frame, as displayed in the figure below:
A Beacon packet is a periodic packet, sent on the network by the Access Point to provide information and notify the AP’s presence on the network. In fact, if we fill in the display filter toolbar with the filter “wlan.fc.type_subtype == 0x08”, we can appreciate the Beacon packets cycle (which in this case is equal to the default value: 100 ms), as displayed in the figure below:
It can also be useful to create an IO Graph for Beacon frames, because they are one of the most important management frames on the WLAN. In fact, consider the case where a user complains about intermittent loss of connectivity to the WLAN. If we create an IO Graph using a filter for beacon frames we can see if there is a problem. Open from the Wireshark Main Menu “Statistics” ➔ “IO Graph” and insert the display filter for beacon frame in the display filter field. The result will be similar to the figure below:
The graph shows that the period of beacon detection is quite constant until 3 seconds of capture. Either the capture is too short, or there is a problem where the access point stopped beaconing for a period.
In the following, some of the most commonly seen 802.11 management frames are reported:
Authentication: STA sends to AP with its identity. OpenSysAuth: AP sends an authentication frame back indicating success or failure; SharedKey: AP sends a challenge text. NIC sends the encrypted version of the challenge text using the key. AP sends an authentication frame indicating success or failure.
Deauthentication: STA sends to terminate secure communications.
Association: Used by AP to synchronize with STA radio and define capabilities.
Reassociation: Sent by STA to new AP; triggers AP to get buffered data (if any) from previous AP. Disassociation: Sent by STA to terminate an association with the AP.
Beacon: Sent every 100 ms (default) by AP to announce its presence and provide info; STAs continuously scan for other APs.
Probe: Request/Response. STA uses this to obtain info from another STA. E.g., to find APs in range (request/response).
In the following, the most commonly seen 802.11 control frames seen are reported:
Request-to-Send: (optional) Used as part of 2-way handshake to request transmission privileges.
Clear-to-Send: (optional) Second part of 2-way handshake.
ACK: Sent by receiver to indicate data frame received, OK. No ACK would trigger an 802.11 retransmission by the sender.
Notes:
Repeat the previous steps, capturing some other capture log file, and try to identify and filter out (also creating IO graphs) Data Frames, Management Frames, and Control Frames in order to get confidence with the packet typology belonging to 802.11.
