Wireless Troubleshooting Tips
using AirPcaps: DFS & Module Debugging
Megumi Takeshita
ikeriri network service co.,ltd
1

Megumi Takeshita, ikeriri network service
a.k.a. packet otaku since first Sharkfest• Founder, ikeriri network service co.,ltd
I am network troubleshooter anddebugger using packet analysis.
• Wrote 10+ books of packet capturing• Reseller of Riverbed Technology (former CACE technologies ) andMetageek, Dualcomm etc. in Japan• Attending all Sharkfest and firsttranslator of QT Wireshark intoJapanese ! 日本語ワイヤーシャーク

Wireless troubleshooting TIPS
using AirPcaps: DFS & Module
Debugging• Now I talk about 20 TIPS
and troubleshooting
in wireless environment• AirPcap(s) is necessary fordebugging in Windowsenvironment.
• Please ask me if you have some question.

3

#1 Collecting host / AP info (Windows)• “netsh wlan sh all | more “
Driver description
Driver version ( important)
INF file nameInterface name
MAC address
SSID / BSSID
authentication/encryption
Channel / speed /signal• Demonstration4

#1 Collecting host / AP info (iOS)• Setting>General>Info“MAC address”• Setting>Privacy>Location
if “disabled” and no carrier
setting may causes
randomize
MAC address (iOS8)• Setting>Wi-Fi
SSID / IP address / mask / gateway / DNS…
5

#1 Collecting host / AP info (AP Side)• SSID / BSSID / Channel /Channel bandwidthconnection speed/mode
encryption type / SSID etc.
• Also check the controller
settings ( if user use ),• Short Guard Interval 20
and Greenfield mode (HighThroughput ) are not supported
by AirPcap series.

6#2 Collecting Baseline of network• Latency and lostof Ping command• tracert and pathping• netstat –a | find “LISTEN”• Iperf ( throughput test )• Demonstration
7

#3 Choosing Physical header type
TypeRadiotap

PPIPacket

We can capture wireless frames as 2 kinds of frame
format in Physical layer using AirPcap and Wireshark8

#3 Choosing Physical header type
TypeRadiotap
GOOD • Easy to read, simple• Fixed format• Easy filter
radiotap.dbm_antsignal

BAD• Cannot collect multiple
anntena information

PPI• Extensible format
future info 11ac, etc• Includes multiple
antenna information• Hard to read, complex• Long filter
ppi.80211n-macphy.dbmant0.signal• RECOMMEND Radiotap in 11a/b/g/n(20MHz)• Demonstration Wireless toolbar> setting9

#4 Using AirPcap(s)• Using multiple AirPcaps
tell us a different discoveryof target devices(multiple channel info)• We can use different PC
with an AirPcap capturing
specific channel(then merge pcap files)• Trying 3 times or moresometimes AirPcap could
not capture the packet.

10

#4 Using AirPcap(s)Setting

Offset -1

Offset 0

Offset +1

ChannelMain Channel 5 + Sub 1
1+5(40MHz)

Channel 5(20MHz)

Main Channel 5 + Sub 9
5+9(40MHz)

Setting

All Frame

Valid Frame Invalid Frame• Demonstration

11

#5 Filtering packet in rough• Wireless trace file is big,
Connected wireless trace files are huge.
• Using Statistics>WLAN Traffic
is the best way to filter packet in rough#5 Filtering packet in rough• Once filter, or Mark packets or something,then File>Export specified packets.
• Iteration of exporting trace file,
we can go back, look up the IO Graph, filteredpackets at the moment.
• Small trace file is also good to open and read• Demonstration

#6 customizing summary pane
• Summary pane is the first chance to find theimportant packet• Choosing field, right click to Apply as Column• Type/Subtype … absolutely Apply as Column
Channel / RSSI / SigStrength / TX Rate …
14

#7 customizing coloring rules• typical troublesome packet
Deauthentication from AP or from Client
wlan.fc.type_subtype==12
Disassociationfrom AP or from Client
wlan.fc.type_subtype==10

#8 Setting WEP Key• WEP decryption in Wireshark is easy.
• Any AP, any Clientany data frame canbe decrypted
if the key is correct

#8 Setting WEP Key• Remember to enter the key in ASCII format
wep128wep128w
77 65 70 31 32 38 77 65 70 31 32 38 77

#9 Setting WPA/WPA2 Key• WPA 1/2 needs both Passphrase and SSID key
input in alphabet format. (or PMK 256bit Hex )• The difficulties lies in EAPOL 4-way handshake.
The complete 4 packet of a series of handshakeis necessary for decryption.
• Note some Windows and IOS use the cache
information of the past connection to the AP,
in this case,decryption fails.

#9 Setting WPA/WPA2 Key• Please note the complete 4 way handshake• Key/SSID wpa2aespsk

#10 Visualization (1) Retry• Easy way to check the CSMA/CA status.
• We can check the retry packet rate, as well as
the throughput of data frame.
• Filter packet within the specified AP or Client• Statistics>IO Graph
Retry rate graph
Y/X axis -> packet/sec
Throughput graph
Y/X axis -> bit/sec

#10 Visualization (1) Retry• Graph1: specified BSSID and data frame• Graph2: the same with Graph1 and“wlan.fc.retry==1”• Demonstration

#11 Visualization (2) Frame type• What type of IEEE802.11 frames in RF isimportant in analysis the compose of frametells us the status of RFStatus

ManagementControl

DataIDLE

Many

Few

Few

BUSY(GOOD)

Few

Many
same as Data

Manysame as Control

BUSY(BAD)

Few

Many
less than Data

Manymore than Control

RTS/CTS(protect mode)

Few

Many
more than Data

Manyless than Control

#11 Visualization (2) Frame type
• Management frame wlan.fc.type==0
Control Frame wlan.fc.type==1
Data Frame ( includes NULL ) wlan.fc.type==2• Statistics>
IO GraphY/X Axis ->packets / sec• This time is
BAD RF(many retry)• Demonstration

#12 Visualization (3) management• Management frame contains many good
information for debugging and troubleshooting.
• Some AP sends important information inmanagement frame.
• IEEE802.11e has QBSS ( QoS Based ServiceSet ) CCA ( Clear Channel Assignment )information that contains the number of theconnected station and utilization of thechannel.

#12 Visualization (3) management
IEEE802.11e Beacon frame contains QBSS Tag

QBS Load Element CCA has the number of theStation and ChannelUtilization
Station Countwlan_mgt.qbss.scount
Channel Utilization
wlan_mgt.qbss.cu
25

#12 Visualization (3) management
Visualizing Station and Utilization• Statistics>IO Graph and set Y Axis to advanced
filtering specified AP and use AVG(*) andcounting Station(Black) / Utilization (Red)• Demonstration26

#13 Visualization (4) signal• Signal / Noise ratio isuseful, and good ratio is
20 ( signal is 10 times
louder than noise )20x log 10/1 = 20dB
• AirPcap collect signal
info and display filter isradiotap.db_antsignal

dB multiple
11.12201821.258925
31.41253841.584893
5
1.778279
6
1.995262
7
2.238721
8
2.511886
92.818383
10
3.162278
11
3.54813412
3.981072
13
4.466836
145.011872
15
5.623413

16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

6.309573
7.079458
7.943282
8.912509
10
11.22018
12.58925
14.12538
15.84893
17.78279
19.95262
22.38721
25.1188628.18383
31.62278

31
32
33
34
35
36
37
38
39
40
41
42
43
44

35.48134
39.81072
44.66836
50.11872
56.23413
63.09573
70.79458
79.43282
89.12509
100112.2018125.8925
141.2538
158.4893

4546
47
48
4950

177.8279
199.5262
223.8721
251.1886281.8383
316.2278

#13 Visualization (4) signal• Statistics > IO Graph and filter AP (Graph1)
and filter Client (Graph2) and set Y axis toadvanced, then counting AVG(*) ofradiotap.db_antsignal• Demonstration

#14 using flow graph• Flow graph is good Obtusely trouble packet• If you need to draw Flow Graph under layer2
old version of Wireshark is good.
• Use Wireshark1.6
or older• Statistics> Flow Graph#15 Repetition of packets (iOS)• Repetition of a series of the packet
gives us the hint for
debugging, troubleshooting.
• This packet contains
the repetition thatEAPOL(mes1/4)
EAPOL(mes2/4)
counts 6 times !
• The troubles lies in here.

#15 Repetition of packets (iOS)• Wrong passphrase
causes network errorof EAPOL 4-way
handshake.
• iOS tried 6 times.

• Demonstration

#16 Wireless Router’s MTU/MSS• Some user says they cannot see specificwebsite. ( ex. Google OK Yahoo NG )• When MTU 1454 (default ), we cannot seeBut MTU 1414, and we CAN SEE

EthernetII(14)

IP(20)
DF=1 MF＝0
Offset＝TCP
(20)

MSS
1460

#16 Wireless Router’s MTU/MSS• PPPoE(FTTH) is popular in Japan.
• NTT west’s MTU is 1454
( Ethernet(1518)-EthernetHeader+FCS(14+4)IP(20)-UDP(20)-L2TP(16)-PPPheader(2) )• NTT east optical fiber network’s MTU is 1438
（ MSS 1398）• MSS value is determined in TCP negotiation,
SYN/SYN-ACK packet in 3 way handshake#16 Wireless Router’s MTU/MSS• MSS values are not the same in the debug.

#17 WPS debugging• Push button connection of WPS between
wireless router and client fails in 40MHz mode,
but it works in 20MHz mode.
• IEEE defines WPS but not in detail implements

#17 WPS debugging• AP sends Request Expand Type,
but Client never response and stacked after
ten times tries, so need to fix the one.

#18 wireless router’s DHCP issue• The wireless router provides same IP address
to another PC and smartphone in same SSID.

#18 wireless router’s DHCP issue• The wireless router sends DHCP-ACKwith 31536000 seconds(3650 days ) of lease timelease time
• Both Windows andsmartphone accepted,but smartphonechanges lease timevalue into 90 days(selfishly)• So IP duplicated.

#19 DFS debugging• There are tons of RF signals in Tokyo central.
2.4GHz bands are worthless, so companies
tends to use 5GHz (W53, W54, W56 channel)• W58 bandwidth is prohibited in Japanese law• In case of indoor office, DFS comes and stack
the communication 30 minutes, no fallback.
• Failed in automatically channel changing, sothe customer have to re-connect manually.

#19 DFS Debugging• Using “tshark –i interface –b filesize:XXX –w
filename.pcapng” and capture for long time.
• We uses 8 PCs with 8 AirPcapNX
with 8 different CHs
W53 ( 52 / 56 /60 / 64 )and W56 ( 100 / 104 /108 / 112 ) channel.
• Capture and wait likefishing, lurk in silence,
until DFS comes( 3 days … )#19 DFS debugging• If you have SteelCentral Packet Analyzer,
you are lucky !
• If trace filesize is 10GB,
it is easy tocreate
many graph,charts under1 minutes

#19 DFS debugging• In deep and complex debugging,
we have to collect a lot of data,and have to combine a lot of data in text.
• File>Export Packet Dissections>as “Plain Text”

#19 DFS debugging• Text based debug is the last resort.
• check a pair of the text translated trace file.
Use the WinMerge

#19 DFS debugging• We found strange management packet atresult.
• Sometimes vender may not admit,
After many months, the fixed patch wasreleased.
• And the wrong detection bug causes thetrouble of the stack and non-recovery problem.

#20 Use Wireshark !
• Wireshark help us finding many bugs andtroubles in debugging and troubleshooting• Use Wireshark !

Thank you !
どうもありがとうございます！

46