Wireshark OTG,

Extend your Wiresharkwith extcap, iPad and Pi#sf21vus--TIPS and tricks of extcap and make use of
Wireshark everywhere, any capture sources
Megumi Takeshita

Ikeriri network serviceMegumi Takeshita, packet otaku
•
•
•
•
•
•
•

Founder, ikeriri network service co., ltd #sf21vus
Reseller of CACE technologies in 2008
Worked SE/IS at BayNetwork, Nortel
Wrote 10+ books about Wireshark
Instruct Wireshark to JSDF and other company
Reseller of packet capture / wireless tools
One of contributors of Wireshark
Translate Wireshark into Japanese2Session Details
Do you imagine your tablet can run Wireshark, Yes you can get Wireshark OTG.
Megumi show you TIPS and tricks to use Wireshark with iPad Pro and Pi.#sf21vus
You may not install many extcap interface that is not installed in default
settings,
It's time to make use of extcap interface such as sshdump.
We can create our own customized extcap interface in easy way on Windows
environment.
Actual demonstration extend your Wireshark's extcap interface!!

Note
Megumi uses iPad Pro, Raspberry Pi and Windows10 environment.
Linux bash and Windows command prompt programming skills help you
understand the session well.

#1 Wireshark OTG
Bring your Witeshark without PC
Witeshark everywhere with iPad Pro
We need◉ An iPad or other tablet◉ A Raspberry pi 4 or zero
◉ A USB-C to USB-C cabletransferring both power and data

#sf21vus

Burn the latest raspberry pi os using official
imager application to microSD card.
◉ We use official raspberry pi imager to install
the latest OS◉ https://www.raspberrypi.org/documentation/in
stallation/installing-images/README.md

Using wired Ethernet connection
to setup raspberry pi at the first◉ I recommend to use Raspberry pi 4 because there are
1 RJ-45 as well as wireless lan ( supports monitor
mode ) and many USB ports#sf21vus

Set raspberry pi as USB Gadget mode
◉ USB Gadget mode is a kind of USB OTG(On-The-Go),◉ Your Pi works as USB host instead of USB devices.
◉ Note: Raspberry Pi zero and 4 support gadget mode.
I recommend to choose Pi4 because Wired LAN,
many USB port and fast

#sf21vus

Edit /boot/config.txt and /cmdLine.txt◉ Set up Pi as USB Gadget mode, that supports
USB-C as power and network◉ ls /boot To find boot option setting file/boot/config.txt and /boot/cmdLine.txt◉ At the last line of /boot/config.txt, add
dtoverlay=dwc2◉ /boot/cmdLine.txt is a long one line file
We need to insert string after “rootwait quiet”
Find “rootwait quiet” and insert string“modules-load=dwc2,g_ether”#sf21vus

SSH/DHCP server setting◉ We need to set up Pi4 act as SSH/DHCP server◉ “touch /boot/ssh” to create blank file for ssh login◉ “nano /etc/modules” to open modules file and add“libcomposite” to define USB3 device.
◉ Install DHCP server “apt-install isc-dhcp-server”
and add “denyinterfaces usb0”
Install dnsmasq with “sudo apt-get install dnsmasq”
Create /etc/dnsmasq.d/usb and edit
Create /etc/network/interfaces.d/usb0 and edit

#sf21vus

/etc/dnsmsq.d/usb
interface=usb0#sf21vus
dhcprange=10.55.0.2,10.55.0.6,255.255.255.248,1hdhcp-option=3/etc/network/interfaces.d/usb0
leasefile-roauto usb0
allow-hotplug usb0
iface usb0 inet static
address 10.55.0.1
netmask 255.255.255.2

Create initialize script “/root/usb.sh” (1)https://www.hardill.me.uk/wordpress/2019/11/02/pi4-usbc-gadget/#sf21vus#!/bin/bash
cd /sys/kernel/config/usb_gadget/
mkdir -p pi4
cd pi4echo 0x1d6b > idVendor # Linux Foundationecho 0x0104 > idProduct # Multifunction Composite Gadget
echo 0x0100 > bcdDevice # v1.0.0
echo 0x0200 > bcdUSB # USB2
echo 0xEF > bDeviceClassecho 0x02 > bDeviceSubClassecho 0x01 > bDeviceProtocol
mkdir -p strings/0x409/configuration

Create initialize script “/root/usb.sh” (2)https://www.hardill.me.uk/wordpress/2019/11/02/pi4-usbc-gadget/#sf21vus
echo 250 > configs/c.1/MaxPower# see gadget configurations below
mkdir -p functions/ecm.usb0
HOST="00:dc:c8:f7:75:14" # "HostPC“SELF="00:dd:dc:eb:6d:a1" # "BadUSB“echo $HOST > functions/ecm.usb0/host_addr
echo $SELF > functions/ecm.usb0/dev_addr
ln -s functions/ecm.usb0 configs/c.1/
udevadm settle -t 5 || :ls /sys/class/udc > UDC ifup usb0
service dnsmasq restartAutorun USB initial script◉ We want to start up USB gadget mode, DHCP Server and#sf21vus
other service every time we start up Pi4
There are nice initial script from “Ben’s Place”
https://www.hardill.me.uk/wordpress/2019/11/02/pi4-usbc-gadget/◉ Make /root/usb.sh executable with chmod +x /root/usb.sh
Add /root/usb.sh before exit 0◉ Set this script every time we power on Pi4
so I use S01cron start script
in /etc/rc3.d(CLI) and /etc/rc5.d (GUI)“sudo halt” to power off raspberry pi,change connection from SSH via wired LAN to USBC
◉ “sudo halt” to power off raspberry pi◉ USE a USBC-USBC cable,
connect between raspberry Pi4 and iPad Pro◉ Pi4 start up with USB Gadget mode and DHCP server#sf21vus

Install ”ish“ from AppStore and packages◉ open AppStore to look for “ish” app (free)◉ “Ish” is a command line shell of iPad OS◉ Open “ish” app and install openssh packages◉ “apk add openssh” and other packages if you needssh pi@10.55.0.1 to login Raspberry Pi 4 via SSH#sf21vus

SSH connection via USB Gadget mode
install RDP server◉ Connect raspberry pi via USB Gadget mode
Pi uses 10.55.0.1, and iPad gets 10.55.0.2 from dhcpd
ssh 10.55.0.1, and enter username and password
pi/raspberry and confirm the connection via USBC
◉ Also recommend to install XRDP ( Remote Desktop
Protocol server) if there are not installed
apt-get install xrdp
◉ Now you can use your Wireshark cli tools such as
dumpcap, tshark, mergecap, editcap, capinfos etc.

#sf21vus

Connect via Microsoft RDP client◉ Install Microsoft RDP iOS client app◉ Open 10.55.0.1 and login as the same as CLI#sf21vus

Bring your Wireshark everywhere◉ Install Microsoft RDP client◉ Create shortcut of 10.55.0.1 via USB-C◉ Username pi◉ Password raspberry◉ Wireshark works
at reasonable speed.
(Pi4 with 8GB RAM)#sf21vus

Change Wireshark permission settings◉ We need administrative privilege to capture packet,#sf21vus
though Raspberry Pi OS works as user mode.
◉ We need to change Wireshark permission to be able tocapture packets in user mode.
◉ “sudo dpkg-reconfigure wireshark-common”◉ Choose YES to capture packets in user mode
◉ “sudo adduser wireshark pi”
to add user pi into wireshark group◉ Restart Raspberry Pi4 and login as pi again

For wireless capturing◉ Capturing wireless network using external WiFi adapter that #sf21vus

supports monitor mode ( unfortunately Pi internal Wireless LAN
card cannot be changed into monitor mode at default setting)◉ You may use Kali Linux ARM image instead of Raspberry Pi OS.
◉ Open ish and check wireless card “sudo iwconfig”◉ “sudo airmon-ng check kill” to stop all wireless related process◉ “sudo airmon-ng start wlan1” to change into monitor mode
◉ ”iwconfig” again to check wlan1 was changed into
wlan1mon (monitor mode interface)◉ Choose “View>Wireless tool bar” to show wireless settings

#2 Extcap brings the external capture source◉ The extcap interface is a versatile plugin interface that#sf21vus
allows external binaries to act as capture interfaces
directly in Wireshark.
◉ It is used in scenarios, where the source of the capture is
not a traditional capture model (live capture from aninterface, from a pipe, from a file, etc). The typicalexample is connecting esoteric hardware of some kind tothe main Wireshark application.and data
◉ Extcaps may be any binary or script within the extcap
directory. Please note, that scripts need to be executablewithout prefacing a script interpreter before the call.

Example extcap interface: SSH remote capture◉ Let’s try sample extcap interface, SSH remote

capture◉ SSH remote capture is provided by SSHDump, is
option component with Wireshark,
so you need to check Tools>SSHDump
Choose Components dialog during Wireshark
installation.

#sf21vus

Example extcap interface: SSH remote capture#sf21vus◉ There are default “SSH remote capture” extcap in Wireshark( you may check Tools>SSH remote capture during install process)◉ Double click extcap icon (left side) to edit option

Test SSH remote capture Extcap interface
1. Start Wireshark#sf21vus

2. Choose “SSH remote capture” interface
3. Click option icon
4. Set Remote SSH server address as some Linux hostthis time we use Raspberry Pi IP address 10.0.0.201
5. Set Remote SSH port number as 22 in the Server Tab

Test SSH remote capture Extcap interface
6. Click Authentication tab, enter Remote SSH#sf21vus
server username ( this time we use “pi” )7. Enter Remote SSH server password ( this time“raspberry”) Note: you may fail at the first time toconnect to save the host’s public key as known host

Test SSH remote capture Extcap interface
8. Click Capture tab, enter Remote interface#sf21vus
Enter Remote capture command ( dumpcap -w -)( this time we use dumpcap command, output pcap
not to file but to standard output "-w -" option
9. Check “Use sudo on the remote machine”
Note Remote capture filter is set automaticallyTest SSH remote capture Extcap interface
11. You can set debug file in case of failure#sf21vus

check “Run in debug mode” and set path in “Use afile for debug” text box

Test SSH remote capture Extcap interface
12. Click Start to capture packet at remote SSH host#sf21vus

13. You can get the trace at the Pi’s side remote LANinterfaceThen let’s test your own extcap interface#sf21vus◉ Extcap is useful so you can extend capture source.
◉ There are some nice hardware, such as Bluetooth

dongle and open source capture devices to capture
via extcap interface.
◉ At first, let’s test your own extcap interface.
Man page of extcap (https://www.wireshark.org/docs/manpages/extcap.html)◉ We do not need to create binary, but just a bit ofbatch file to test extcap interface

Check your extcap path
Help>About Wireshark>Folder◉ Personal Extcap Path in Windows Default
C:¥Users¥user¥AppData¥Roaming¥Wireshark¥extcap◉ Global Extcap Path in Windows Default
C:¥Program Files¥Wireshark¥extcap#sf21vus

Extcap man page (https://www.wireshark.org/docs/manelements
pages/extcap.html)
arg (options) argument for CLI callingnumber

Reference # of argument for other values, display order

call

Literal argument to call (--call=...)

display

Displayed namedefault

Default value, in proper form for type

range

Range of valid values for UI checking (min,max) in proper form

type

Argument type for UI filtering for raw, or UI type for selector:
integer
unsignedlong (may include scientific / special notation)
float
selector (display selector table, all values as strings)
boolean (display checkbox)
radio (display group of radio buttons with provided values, all values as strings)
fileselect (display a dialog to select a file from the filesystem, value as string)
multicheck (display a textbox for selecting multiple options, values as strings)
password (display a textbox with masked text)
timestamp (display a calendar)

value(options)

Values for argument selection
arg Argument # this value applies to#sf21vus

Create example.bat
and copy into Personal Extcap Path
Example.bat#sf21vus

echo interface {value=test}{display=Test Extcap Interface}echo dlt {number=147}{name=test}{display=Layer2 DLT}
echo arg {number=1}{call=--host}{display=Filter Hostname}{type=string}{tooltip=hostname}{required=true}{default=10.0.0.201}{group=Host}echo arg {number=2}{call=--port}{display=Filter Port number}{type=unsigned}{tooltip=port}{range=1,65535}{default=22}{group=Port}

Open Wireshark and Capture>Option
to check Extcap Interface#sf21vusinterface {value=test}{display=Test Extcap Interface}

You can find your Extcap interface at Interface list in
your Wireshark startup screen
dlt {number=147}{name=test}{display=Layer2 DLT}

Select Capture>Option and look the Link layer header
Column to check your extcap data link type value

Click option button () to find your extcap dialog(1){group=Host}{display=Filter Hostname}{default=10.0.0.201}#sf21vus

echo arg {number=1}{call=--host}{display=Filter Hostname}{type=string}{tooltip=host}{required=true}{default=10.0.0.201}{group=Host}

You can create your Extcap Option GUI using script
Set number to set reference number and display orderSet call to call function ( this time do nothing)Set display to set the display nameSet type to set the type definition (this time is string)Set tooltip to set tooltip string
Set required to set this value is necessary
Set default to set default value
Set group to set the tab name

Click option button () to find your extcap dialog(2){group=Port}#sf21vus{display=Filter Port number} {default=22}
echo arg {number=2}{call=--port}{display=Filter Port number}{type=unsigned}{tooltip=port}{range=1,65535}{default=22}{group=Port}You can create your Extcap Option GUI using script
Set number to set reference number and display orderSet call to call function ( this time do nothing)Set display to set the display nameSet type to set type definition (this time is unsigned)
Set tooltip to set tooltip string
Set range to set the range of the value ( this time is from 1 to 65535)
Set default to set default value
Set group to set the tab nameThen check SSHDump command◉ Open Global Extcap Path in explorer#sf21vus
in Windows Default C:¥Program Files¥Wireshark¥extcap◉ Check sshdump.exe is in Global Extcap path
◉ Open command prompt and execute sshdump.exe

sshdump.exe command◉ Check online help of sshdump.exe#sf21vus◉ There are many options for sshdump

sshdump.exe options--extcap-interfaces: list the extcap Interfaces--sshkey <public key path>: the path of the ssh key--extcap-dlts: list the DLTs--sshkey-passphrase <public key passphrase>:#sf21vus
the passphrase to unlock public
ssh--extcap-interface <iface>: specify the extcap interface--extcap-config: list the additional configuration for an int --proxycommand <proxy command>:the command to use as proxy the the ssh connection--capture: run the capture--remote-interface <iface>: the remote capture interface--extcap-capture-filter <filter>: the capture filter--remote-capture-command <capture command>:--fifo <file>: dump data to file or fifo
the remote capture command--remote-sudo: use sudo on the remote machine to capture--extcap-version: print tool version--remote-noprom: don't use promiscuous mode--debug: print additional messages
on the remote machine--debug-file: print debug messages to file--remote-filter <filter>: a filter for remote capture--help: print this help
(default: don't listen on local interfaces IPs)--version: print the version--remote-count <count>: the number of packets to capture--remote-host <host>: the remote SSH host--remote-port <port>: the remote SSH port--remote-username <username>: the remote SSH username--remote-password <password>: the remote SSH password.
If not specified, ssh-agent and ssh-key are used

Check debug.txt created by sshdump.exe◉ We make use of sshdump.exe to create

our own extcap interface#sf21vus

sshdump.exe command◉ we need to create the command like below#sf21vus"C:¥Program Files¥Wireshark¥extcap¥sshdump.exe" –capture--extcap-interface sshdump.exe --fifo %fifo% --remote-host
10.0.0.201 --remote-port 22 --remote-password raspberry--debug --remote-sudo --remote-capture-command"dumpcap -P -w -" --debug-file
C:¥Users¥TakeshitaMegumi¥Desktop¥debug.txt--remote-username pi --remote-interface eth0 true
So let’s create example2.bat file to create your own extcap
interface to make use of SSHDumpexample2.bat (initialization)
set "capture=0"
set "extcap_interfaces=0"
set "extcap_interface="set "extcap_dlts=0"
set "fifo=“

Initialization of commandvariables such as capture,
extcap_interfaces, extcap_
interface, extcap_dlts, fifo
Flag 0:off 1:on

#sf21vus

is the first parameter without
example2.bat (parse) %~1
quarts, %~2 is the second.

:parse
REM check command line parameters#sf21vus
If there are no parameter,
if "%~1"=="" goto :mainjump to the main function.
if /i "%~1"=="--capture" set "capture=1" & shift & goto :parse
if /i "%~1"=="--extcap-interfaces" set "extcap_interfaces=1" & shift &goto :parse
if /i "%~1"=="--extcap-interface" set "extcap_interface=%~2" & shift &shift & goto :parse
if /i "%~1"=="--fifo" set "fifo=%~2" & shift & shift & goto :parse
if /i "%~1"=="--extcap-dlts" set "extcap_dlts=1" & shift & goto :parseshift
Check command line parameters, and if the parameter matches the option,
goto :parse set the flag as 1, use shift to adjust parameter and jump parse again(shift decrease the position of the parameter and save.

example2.bat (main) Main function check each flags
and jump at corresponding labels:main#sf21vus
REM - Process request for interface list from Wireshark
if "%extcap_interfaces%"=="1" call :extcap_interface_func & goto :end
REM - Process request for dlts list from Wireshark
if "%extcap_dlts%"=="1" call :extcap_dlts_func & goto :end
REM - Process capture request
if "%capture%"=="1" call :capture_func & goto :end
exit /B 1
Check command line parameters, and if theparameter matches the option, set the flag as 1 andjump parse again

example2.bat (extcap_interface_func):extcap_interface_func
echo interface {value=test2}{display=Capture from Pi}
exit /B 0
Show extcap interface as the request for#sf21vusinterface list from Wireshark and exit

example2.bat (extcap_dlts_func):extcap_dlts_func
echo dlt {number=147}{name=test2}{display=Layer2 DLT}
exit /B 0
Show datalink header type as the request for
dlts from Wireshark and exit

example2.bat (capture_func):capture_func"C:¥Program Files¥Wireshark¥extcap¥sshdump.exe“--capture --extcap-interface sshdump.exe --fifo %fifo%--remote-host 10.0.0.201 --remote-port 22--remote-password raspberry --debug --remote-sudo--remote-capture-command "dumpcap -P -w -"--debug-file C:¥Users¥TakeshitaMegumi¥Desktop¥debug.txt--remote-username pi --remote-interface eth0 true
exit /B#sf21vus

Call sshdump.exe with adequate parameters

example2.bat (end):endexit /B“exit /B” do not terminate the command but just quit preserving
variables.

Let’s try your customized extcap interface
1. Copy example2.bat to the personal extcap path#sf21vus(C:¥Users¥username¥AppData¥Roaming¥Wireshark¥extcap)
2. Close and open Wireshark and check your own extcap interafaces( Capture from Pi )3. Double click “Capture from Pi” and get the trace

Let’s try your customized extcap interface#sf21vus◉ Just a double click of your own extcap interface,

you can get traces from remote host using WiresharkReference :Windows 10 Wireshark Plug-in for
WLANPi Wireless Captures (wlan-extcap-win)#sf21vus◉ Instead of batch file programing, You may also use nice batch file, wlan-

extcap-win by wifinigel
https://github.com/wifinigel/wlan-extcap-win◉ It is nice batch file script based on Adrian Granados' original python
scripts on the wlan-extcap project (macOS)◉ We can use Raspberry Pi’s monitor mode Wi-Fi interface as one of extcap
interfaces to make use of SSHDump

Download wlanpidump.bat and save to Extcap path
◉ Download batch file “wlanpidump.bat” and save to personal Extcap#sf21vus
path (C:¥Users¥user¥AppData¥Roaming¥Wireshark¥extcap)◉ Edit wlanpidump.bat and find “set capture_cmd” section

The batch file create GUI of wireless settings, set parameters, set wirelessinterface as monitor mode, create capture command and call SSHDump to
capture wireless packet via ssh connection from Raspberry Pi

Use wlan-extcap-win extcap interface
1. Close and open Wireshark again
2. You can find WLAN Pi extcap interface
3. Click Option icon
4. Choose Channel and Channel Width in Capture TAB( this time we use Channel 1 and 20MHz bandwidth )#sf21vus

Use wlan-extcap-win extcap interface
5. Set Remote host IP address and Port in WLAN Pi #sf21vus

Address and WLAN Pi Port fields in Server tab( used for SSHDump parameter)
6. Set Remote host username and password in
Authentication tab

Use wlan-extcap-win extcap interface
7. Set remote interface, capture filter (option),#sf21vus

Frame Slice, and Sync WLANPi Time option inadvanced tap (we use wlan1 as remote interface, nocapture filter, capture all frames using 0 as Frame
Slice and disabled Sync WLANPi Time)
8. Click Start to capture wireless packet via Raspberry Pi

USE WIRESHARK#sf21vus

Thank you for watching !!
Please complete the SharkFest Europe app-based survey

ikeriri network service

http://www.ikeriri.ne.jp52