Dissecting WiFi6using WIreshark#sf21veu

Megumi Takeshita
Ikeriri network serviceMegumi Takeshita, packet otaku•••••••

Founder, ikeriri network service co., ltd #sf21veu
Reseller of CACE technologies in 2008
Worked SE/IS at BayNetwork, Nortel
Wrote 10+ books about Wireshark
Instruct Wireshark to JSDF and other company
Reseller of packet capture / wireless tools
One of contributors of Wireshark
Translate Wireshark into Japanese2

18 Dissecting WiFi6 using WIreshark#sf21veu

It's time to capture WiFi6 and dissect IEEE802.11ax usingWireshark!! new method to capture traffic and filter, profileand so on. Wireless protocol
evolves year by year, now new HE ( High-Efficiency) ages
comes to us, the instructor will show you IEEE802.11ax
protocols and the difference withformer Wi-Fi, And she will demonstrate the way to capture
WiFi6 with new software/hardware. The session will also
include a Wi-Fi6 specified profile
including display filter/ filter button, coloring rule and so on 3

Wi-Fi specification of IEEE802.11
Wi-Fi alliance named as Wi-Fi X#sf21veu◉ WiFi4 IEEE802.11n 2.4GHz/5GHz ～1.2Gbps/64QAM◉ WiFi5 IEEE802.11ac works only 5GHz ～3.5Gbps/256QAM◉ WiFi6 IEEE802.11ax 2.4GHz/5GHz ～9.6Gbps/1024QAM◉ WiFi6E IEEE802.11ax and 6GHz ～9.6Gbps/1024QAM
Unfortunately Japanese Ministry of Internal Affairs andCommunications may not allow 6GHz until 2022..
◉ Wi-Fi7 IEEE802.11be and 2.4/5/6GHz ～46Gbps/4096QAM
WiFi6 is common specification of wireless standard
4

Big change of Wi-Fi 6#sf21veu◉ Wi-Fi is a kind of repeater of 10BASE2/5 until WiFi5◉ All Clients connected with AP never send a packet at a time,clients share a frequency and one uses the channel, theothers have to wait for the end of sending.
(a.k.a Wired CSMA/CD, Wireless CSMA/CA)◉ WiFi6 uses OFDMA as well as OFDM
OFDMA (Orthogonal Frequency Division
Multiple Access) is used by LTE too.
5

From OFDM to OFDMA◉ OFDMA divide #sf21veu
channel by RU toassign users

RU(Resource Unit) 2MHz
74user in 160MHz

Frequency(20MHz-160MHz)

User A

User A
User CTimeTime

User B

Resource Unit/Bandwidth26-Tone RU
52-Tone RU
106-Tone RU
242-Tone RU
484-Tone RU
996-Tone RU

User B

Frequency(20MHz-160MHz)

2030

80 1609 18482412N/A
1N/A N/A37 74
16 32
8 164 8
2 41 2◉ WiFi6 also uses MUMIMO with multipleantennas/streams 6

MCS Modulation and Coding Scheme#sf21veu

Wi-Fi physical spec has different sets of Spatial streams,
Modulation type: Way to send bit by 1 wave ( signal),
Coding Rate: Percentage of data stream used to transmit data,
Guard interval: time between each frame and bandwidth
MCS determines logical speed of wireless network◉ WiFi4 HT High Throughput ～64QAM / 40MHz BW◉ Wi-Fi5 VHT Very High Throughput ～256QAM / 160MHz BW◉ WiFi6/WiFi6E HE High Efficiency ～1024QAM / 160MHz BW
7◉ Wi-Fi7 EHT Extremely High Throughput ～4096QAM / 320MHz

mscindex.com(MU-OFDMA 802.11ax)#sf21veu

8Capturing WiFi6 in Windows10#sf21veu

There are many new features such as OFDMA, MU-MIMO, beam
forming, higher order of modulation, power consumption, newinterval/symbols/FFT(Fast Fourier Transform size), etc.
https://standards.ieee.org/project/802_11ax.html
OK, its time to capture WiFi6, We wants to capture WiFi6 in
Windows10 environment, so we choose TamoSoft CommView
for Wi-Fi and Intel AX200 M.2 Wireless card.
Note: there are another way to capture WiFi6 such as using
extcap interface of Wireshark to connect access point worked
9as sniffer mode, Linux way, or MacOS way.

ASUS RT-AX89X Wi-Fi 6, 1024QAM
MU-MIMO, HE160 and HE80+80
https://deviwiki.com/wiki/ASUS_RT-AX89X#sf21veu

This time we test RT-AC89X
and iPad Pro 11(2nd gen),iOS 14.6,802.11ax Wi-Fi 6 2x2 MIMO
5GHz max PHY 1200Mbps
Bandwidth 80MHz
Max MCS11(HE)https://support.apple.com/ja-jp/guide/deploymentreference-ios/apd9f0a6151e/web(Qualcomm Snapdragon X55 5G Modem)

10

#sf21veu

https://wikidevi.wi-cat.ru/Intel_Wi-Fi_6_AX200_(AX200NGW)◉ Windows10 Pro 64bit◉ Intel AX200 NGW◉ TamoSoft CommViewfor Wi-Fi

You can capture WiFi6
frames with 160MHz
bandwidth, 1024QAM byIntel AX200 NGW andCommView for Wi-Fi

11

DEMO1 Ping to wired PC (cleartext)◉ SSID:wifi6◉ Security: cleartext◉ BSSID:F02F74C4F5C0◉ STA iPad:060F5BDD20FA◉ Channel 64ch
(1)Connect iPad to AP(2)Ping to a wired PC(3)Click Forget Network to
disconnect AP#sf21veu

12Use CommView to capture packets#sf21veu

capture
CH 64

SSID wifi6
BSSIDCH 64

cleartext

Max Rate

I use CommView with AX200 tocapture packets at CH64, save trace
file as ncfx TamoSoft format, thenexport it as pcapng. ( some filtered)13Original ncfx file:beacon frame from AP#sf21veu

SSID wifi6Ext. tag HE Capabilities (IEEE Std 802.11ax/D3.0)
Ext. tag HE Operation (IEEE Std 802.11ax/D3.0)Ext. tag Spatial Reuse Parameter Set
Ext. tag MU EDCA Parameter Set

14

Sample trace file: cleartext.pcapng#sf21veu

cleartext.pcapng is a kind of typical communication between
STA(06:0f:5b:dd:20:fa) and AP(ASUSTekC_c4:f5:c4)
Note: iPad pro uses private mac address so Probe Request andProbe Response frame’s mac address is not match correctly.
15
There are tons of fields, so we focus main fields and functions.

Sample trace file: cleartext.pcapng#sf21veu◉ #1 STA(iPad Pro) receive ASUS(SSID is wifi6) Beacon◉ #2 #3 Probe Request <> Probe Response◉ #4 #5 Authentication (Open System)◉ #6 #7 Association Request <> Association Response◉ #8-#14 Plaintext Data such as DHCP, ICMP
◉ #15 Disassociate from STA

16

#1 Beacon from AP#sf21veu

SSID wifi6Ext. tag HE Capabilities (IEEE Std 802.11ax/D3.0)
Ext. tag HE Operation (IEEE Std 802.11ax/D3.0)

Ext. tag Spatial Reuse Parameter Set)
Ext. tag MU EDCA Parameter Set
17

HE Capabilities show ax specification of AP#sf21veu

HE Capabilities are parts ofIEEE802.11 Wireless Management
header of Beason frame, andthey include AP’s specification ofIEEE802.11ax, there are a lot offields, for example, supported
HE-MCS and NSS Set with RX/TX
MCS number with Spatial Streams
and RU allocation.
18

#2 Probe Request from STA#sf21veu

Wildcard SSID ( for the first time from STA)
Ext. tag HE Capabilities (IEEE Std 802.11ax/D3.0)
HE MAC Capabilities

HE PHY Capabilities

Supported HE-MCS and NSS Set

PPE Thresholds

19

STA sends ax specification of AP#sf21veu

STA sends IEEE802.11ax
specification in Probe Request
frame. There are a lot of fields,For example, STA sends
supported MCS, bandwidth, RU
allocation in HE-MCS and NSS
Set and PPE Thresholds fields.
20

#3 Probe Response from AP#sf21veu

SSID: wifi6Ext. tag HE Capabilities (IEEE Std 802.11ax/D3.0)
Ext. tag HE Operation (IEEE Std 802.11ax/D3.0)

Ext. tag Spatial Reuse Parameter Set
Ext Tag: MU EDCA Parameter Set
21

AP sends IEEE802.11ax specification#sf21veu

HE Capabilities are parts ofIEEE802.11 Wireless Management
header of Probe Response frame,and they include AP’s .11ax setting
to STA. There are a lot of fields,
for example, supported HE-MCS
and NSS Set with RX/TX MCS
number with Spatial Streams andRU allocation.
22

#4 #5 Authentication (Open System)#sf21veu

Authentication Algorithm: Open System
Status code: Successful
Tag: Extend Capabilities

Tag: Vendor Specific: Apple and Broadcom

Authentication process of 11ax is the same as other legacy
Wi-Fi, just check SSID name using Open System algorithm23

#6 Association Request from STA#sf21veu

SSID: wifi6Ext. tag HE Capabilities (IEEE Std 802.11ax/D3.0)

HE MAC Capabilities Information
HE PHY Capabilities Information
Supported HE-MCS and NSS Set
PPE Thresholds

24

STA sends actual connection settings
STA sends actual connection#sf21veu
settings to AP.
◉ Bandwidth <=80MHz◉ MCS 0-11
◉ Spatial Streams 1-2◉ RU 242,484,996
There are other many setting
information in HE MAC
Capabilities and HE PHY
Capabilities, Supported
25
Channels, SSID and so on.

3.2μs Guard Interval Supported#sf21veu

STA support 1.6μs/3.2μs Guard Interval, so logical rate isdetermined by MCS index from 7.3Mbps to1134.3Mbps(if STA uses Wi-Fi6 mode)26#8 Association Response from AP#sf21veu

Status Code Successful
Association ID: 0x00001

Ext. tag HE Capabilities (IEEE Std 802.11ax/D3.0)
Ext. tag HE Operation (IEEE Std 802.11ax/D3.0)
Ext. tag Spatial Reuse Parameter Set

Ext Tag: MU EDCA Parameter Set

27

AP linked up layer2 connection to STA
Association Response means AP#sf21veu
determined setting configuration,
confirmed connection from STA,
and linked up and start actual dataAP also logged association (HE Bandwidth communication with STA.
80MHz TX Max 720Mbps RX Max 286Mbps)

28

AP sends actual connection settings
AP sends actual connection#sf21veu
settings to STA.
◉ Bandwidth <=80MHz◉ MCS 0-11
◉ Spatial Streams 1-2◉ RU 242,484,996,2x996
There are other many setting
information in HE MAC
Capabilities and HE PHY
Capabilities, Supported
29
Channels, SSID and so on.

new function: BSS coloring, modified CSMA/CA

There are many other wirelessaccess point in todays Wi-Fi, you
may see tons of SSID if you are indowntown. WiFi6 uses BSS(BasicService Set) Coloring, a group ofAP and STAs connected with AP set“Color” to identify communication.

In Carrier Sense process, AP/STAs#sf21veu
wait for a while (timer + random),then send frames when they receive
frames in the same color over RSSI
signal threshold.
AP changes Carrier Sense threshold
dynamically if the color is not same.
It means “Oh, other system use thesame Wi-Fi Channel, but not me, so I
loose interferer threshold”

BSS Coloring utilize RF band more efficiently and get better performance( especially in outdoor, downtown and other congestion wireless network)30

new function: Triger frame for TWT
In legacy Wi-Fi we have to use power
management flag to sleep or wake upall#sf21veu
STAs in BSS
TWT (Target Wake Time) is the new Wi-Fi6
mechanism that set individual sleep time
between AP and STAs
STA set individual wake time in association.
AP sends trigger packet to wake up the STA
and STA sends back if needed.
WiFi6 also use CSI(Channel StateInformation) from chipset for beamforming.

TWT (Target Wake Time) is the best solution for IoT devices31

AP specification#sf21veu

AP support 0.8μs/1.6μs Guard Interval, 8 Spatial Streams, HEMCS 0-11 and RU tone 242,484,996.
32

#8-#14 Plaintext Data such as DHCP, ICMP
Frame type_subtype: Data Subtype 8#sf21veu

Data frames uses common IEEE802.11 mac
frame format including HT Control information
header that have HE (IEEE802.11ax) flag is TrueHT Control (+HTC) header

HE: True (IEEE802.11ax)
Aggregate Control Header

33

Unfortunately some Radiotap Header and RF
information do not export correctly (for now)
#sf21veu

CommView does not export all
fields in pcapng correctly, PHY
Type, MCS, number of Spatial
Streams, Channel bandwidthand some fields are omitted,
PHY type, Data rate fields are
not dissected correctly ( fornow ) and Richard-san (RichardSharpe) and Guy-san (GuyHarris) work for Wireshark-side.
34

#15 Disassociate from STA
Type/Subtype: Disassociate#sf21veu

From STA address

Disassociate from STA

Last frame is common in Wi-Fi, STA says goodbye to AP
using disassociate frame. And AP delete association andauthentication state and disconnect datalink. Done.

35

Appendix Ping/iperf3 to wired PC with WPA2
◉ SSID:wifi6◉ Passphrase: Wireshark◉ BSSID:F02F74C4F5C0◉ STA iPad:060F5BDD20FA◉ Channel 128MHz(1)Connect iPad to AP(2)Ping to a wired PC(3)Use iperf3 to measurethroughput#sf21veu

36

Appendix Ping/iperf3 to wired PC with WPA2
#sf21veu

Actual throughput is about 200Mbps
37

Appendix Ping/iperf3 to wired PC with WPA2
#sf21veu

CommView can decrypt WPA2-PSK, so we can see plain iperf
frame if we capture complete 4 set of EAPOL handshake andenter WPA-PSK passphrase in WEP/WPA key settings.
Export pcapng file is plain text IEEE802.11 trace file.
38

Its just an entrance of dissecting WiFi6!!
We dissected a simple Wi-Fi 6 connection setup process,#sf21veu
You may think packet dissection is not changed a lot
from legacy trace, yes we use the same IEEE802.11
standards, and you may find there are many newheaders and fields specified for IEEE802.11ax.
WiFi6/6E is new protocols so capture tools and software
is now developing and off course Wireshark dissector
will be updated. This is just an entrance of dissecting.
USE WIRESHARK to troubleshoot and debug Wi-Fi 6!!
39

USE WIRESHARK#sf21veu

Thank you for watching !!
Please complete the SharkFest Europe app-based survey

ikeriri network service

http://www.ikeriri.ne.jp40