Quick Help
25/04/2016
support@acrylicwifi.com
www.acrylicwifi.com

Acrylic WiFi Professional - ©2016 – Tarlogic Security SL2

ContentAccess Points .......................................................................................................................... 4
Additional Options ............................................................................................................. 7
Stations ................................................................................................................................... 8
Additional Options ........................................................................................................... 10
Inventory .............................................................................................................................. 11
Additional options ........................................................................................................... 11
Packet viewer ....................................................................................................................... 13
Filter examples ................................................................................................................ 13
Syntax ............................................................................................................................... 13
Valid Operators ................................................................................................................ 14
Types ................................................................................................................................ 14
Scripts ................................................................................................................................... 16
Script Editor ..................................................................................................................... 16
Editor options .............................................................................................................. 18
Script list........................................................................................................................... 18

Acrylic WiFi Professional - ©2016 – Tarlogic Security SL3

Access Points
This section displays a general overview of all detected Wi-Fi access points.

Each row represents an access point, and each column includes information such as signal
strength, SNR, MAC address, security options, etc.
By using the Monitor Mode (NDIS) or an AirPcap card, you can also visualize all connectedclient devices to each access point. In case an access point has client devices connected
to it, these are listed in the row below that access point. The tree expands when clicking
on the '+' sign icon, displaying all the client devices connected to the selected accesspoint.
This window offers helpful information on Wi-Fi device status at a glance.
To hide the access points on the lower views, the colored checkboxes should beunchecked.
ColumnSSID

Information Provided
This acronym stands for 'Service Set IDentifier'. In other words, thenetwork'sname.
A network can hide its name, in which case this field reads the text
[Hidden]. This text can be configured from the Preferences window that
Acrylic WiFi Professional - ©2016 – Tarlogic Security SL4Column#Mac
Address

RSSI

SNR

Chan

Width

802.11
Max rate

Information Provided
appears after clicking on the Configure option in the main menu.
However, even when a network is not publishing its name, in some cases,
the network name can be obtained on Monitor Mode by inspecting andanalyzing the Wi-Fi traffic of the devices that are connected to thatnetwork.
Whenever possible, Acrylic will display this name in red, which means that
this is a hidden network and the name has been inferred by the software.
This column displays the number of devices connected to that network. If
empty, this means that no device has been detected as connected to thenetwork.
NOTE: Values are only shown on Monitor Mode (NDIS) or when using anAirPcap card. If the Wi-Fi device is operating on Normal Mode, this field isautomatically hidden.
A Media Access Control Address is a unique identifier assigned to network
interfacesandused
asanetwork
address.
This field can display a name instead of the 6-bytes address when the MAC
address is previously inventoried.
A Received Signal Strength Indication is a dBm value that indicates thewireless signal strength received by the client, and it usually ranges from0to-100.
The higher the value, the stronger the signal, being 0 the weakest and 100 the strongest.
The Signal-to-Noise Ratio measured in dB that is used to compare thesignal received with the background noise. The higher the value, thebetterthecommunicationquality.
NOTE: These values are only shown if an AirPcap card is used. If the Wi-Fi
device is operating on normal or monitor (NDIS) mode, this field isautomatically hidden.
Network operating channel. If the network is operating over more than
one channel, all operating channels are displayed here.
On the 2.4GHz frequency, access points can operate over either one ortwochannels.
On the 5GHz frequency, they can operate over up to four channels.
Channel bandwidth measured in Mhz. Possible values are 20, 40, 80, and160.
On the 2.4GHz frequency, access points can have a bandwidth of 20 and40MHz.
On the 2.4GHz frequency, access points can have a bandwidth of 20 and40MHz.
Access point communication standards. Possible values are a combinationof 802.11(a,b,g,n,ac).
Maximum transfer rate supported by a network access point measured inMb/s.

Acrylic WiFi Professional - ©2016 – Tarlogic Security SL5ColumnRetries

WEPWPA

WPA2WPS

Password

WPS PINVendor

DataMgt
First
Last
Type

Information Provided
Percentage of packets that had to be retransmitted due to transmission
errors. The total number of retransmitted packets are shown between
brackets.
It is a percentage, ranging from 0 to 100. Values over 10% are considered
to have a negative impact on network performance.
NOTE: Values are only shown on Monitor Mode (NDIS) or when using an
AirPcap card. If the Wi-Fi device is operating on Normal Mode, this field is
automatically hidden.
Access point WEP security type. If empty, this means that the networkdoes not support WEP security. Possible values are 'SharedKey' and'Open'.
Access point WPA security type. If empty, this means that WPA security isnot supported by the network. Possible values are 'PSK' (PreShared Key)and 'MGT' (Managed, also known as Enterprise).
Access point WPA2 security type. If empty, this means that WPA2 security
is not supported by the network. Possible values are 'PSK' (PreShared Key)and 'MGT' (Managed, also known as Enterprise).
WPS version supported by the access point. If empty, this means that WPS
is not supported by the network. WPS authentication is displayed in green
if enabled, or otherwise in red.
Some access points provided by ISPs include default passwords. The
Scripting section contains scripts that identify those access points andreveal the default password. One or more passwords can be revealed,depending on the device model. In any case, it is possible to use aconnectivity module to test a number of passwords on the access point.
Please, bear in mind that only a default password can be revealed, so theuser should change it for security purposes.
Some access points provided by ISPs include Pin WPS by default. TheScripting section contains scripts that identify those access points andreveal the WSP PIN. One or more WSP PINs can be revealed, dependingon the device model.
The manufacturer brand name of the network interface being used by thedevice
Number of Data packets sent by the wireless device.
NOTE: Values are only shown on Monitor Mode (NDIS) or when using anAirPcap card. If the Wi-Fi device is operating on Normal Mode, this field is
automatically hidden.
Number of Management packets sent by the wireless device.
Time at which a device has been first detected.
Time at which a device has been last detected.
Network type implemented by the access point. Possible values are'Infrastructure' and 'Adhoc'.

Acrylic WiFi Professional - ©2016 – Tarlogic Security SL6Column
LatitudeLongitude

Information Provided
GPS latitude of the location where the device has been first detected.
NOTE: A GPS device should be connected and a coordinates' capture
initiated or otherwise this field will be automatically hidden.
GPS longitude of the location where the device has been first detected.
NOTE: A GPS device should be connected and a coordinate capture
initiated or otherwise this field will be automatically hidden.

Additional Options
Right-clicking on the Access Points window will display the context menu that allows to
perform actions on access points and client devices.

Acrylic WiFi Professional - ©2016 – Tarlogic Security SL7

Stations
The Stations section displays all the Wi-Fi capable devices.
Generally, a Wi-Fi capable device is called a STATION or STA.

Wi-Fi devices send wireless network packets following the 802.11 protocol whileoperative. An access point broadcasts a certain wireless network, and devices such as
mobile phones, tablets or laptop computers send network packets searching for availablenetworks.
Each device has a unique 6-byte identification address called MAC. Acrylic Wi-Fi
Professional gathers each device information and provides transmission metrics that are
displayed in the following table:

ColumnMac
Address

Information Provided
A Media Access Control Address is a unique identifier assigned tonetwork interfaces and used as a network address.
This field can display a name instead of the 6-bytes address when theMAC address is previously inventoried.
Acrylic WiFi Professional - ©2016 – Tarlogic Security SL

8Column

RSSI

SNR

Current
StateVendor
Wps InfoRetries

Attempts# Sent#Received

Information Provided
A Received Signal Strength Indication is a dBm value that indicates thewireless signal strength received by the client, and it usually ranges from0 to -100.
The higher the value, the stronger the signal, being 0 the weakest and 100 the strongest.
Signal-to-Noise Ratio measured in dB that is used to compare the signal
received with the background noise. The higher the value, the better thecommunication quality.
NOTE: These values are only shown if an AirPcap card is used. If the Wi-Fi
device is operating in normal or monitor (NDIS) mode, this field is
automatically hidden.
Acrylic Wi-Fi Professional device categorization according to device
current operating mode.
StatusDescription
AccessPoint
The device operates as an access point.
The device is requesting network access. This is
ClientRequesting the normal status for smartphones, tablets,
laptops, etc.
ClientConnected This is a device connected to another Wi-Fi device.
The device is sending wireless network packets,
UndefinedActive
but it still cannot be classified.
The device is receiving wireless network packets,
UndefinedPassive
but it still cannot be classified.
The device is operating as a Wireless Distribution
WDS
System (WDS).
Unknown
The device cannot be identified.
The manufacturer brand name of the network interface being used.
This indicates whether the device supports WPS and the amount of
information it provides.
Percentage of packets that had to be retransmitted due to transmission
errors. The total number of retransmitted packets is shown between
brackets.
It is a percentage, ranging from 0 to 100. Values over 10% areconsidered to have a negative impact on network performance.
NOTE: These values are only shown on Monitor Mode (NDIS) or whenusing an AirPcap card. If the Wi-Fi device is operating on normal mode,
this field is automatically hidden.
Number of attempts from a wireless device trying to connect to anotherdevice.
NOTE: These values are only shown on Monitor Mode (NDIS) or whenusing an AirPcap card.
Number of network packets sent by a wireless device.
Number of network packets received by a wireless device.
Acrylic WiFi Professional - ©2016 – Tarlogic Security SL9Column# BSSID
FirstLast
DataMgt

Information Provided
Number of packets a wireless device acts as an intermediary of.
Time at which a device has been first detected.
Time at which a device has been last detected.
Number of Data packets sent by a wireless device.
NOTE: These values are only shown on Monitor Mode (NDIS) or whenusing an AirPcap card. If the Wi-Fi device is operating on normal mode,
this field is automatically hidden.
Number of Management packets sent by a wireless device.

Additional Options
It is possible to interact with the devices shown in this section by using the right-click
context menu.
From this context menu, you can interact with all the listed Stations and perform tasks
such as generating reports in HTML, TXT or CSV format, tweet device information, or copy
to clipboard.

Acrylic WiFi Professional - ©2016 – Tarlogic Security SL

10Inventory
In this section all devices which had been inventoried are listed.
When a device is inventoried, a friendly name is assigned to his MAC Address, so eachtime you use Acrylic Wi-Fi, this device appears identified with the assigned name insteadof the MAC Address.

ColumnMacAddress
NameVendor

What information gives?
Unique identifier assigned to network interfaces used as a network address(Media Access Control Address)
Friendly name given to this device.
This name will be displayed in Acrylic Wi-Fi instead of the MAC Address.
Name of the manufacturer of the device. Non editable, is obtained
automatically based on the MAC Address

Additional options

Contextual menu only available when pressing the right button on the inventory window
Acrylic WiFi Professional - ©2016 – Tarlogic Security SL11Menu item
Add newModify
DeleteCopy to clipboard
Export to file
Import from file

Function
Adds a new entry in the inventory
Allows to modify the information of an inventoried element
Removes an inventoried element
Allows to copy inventoried elements information on theclipboard
Allows to export inventory content to .csv file
Allows to import inventory content from .csv file

The window to add or modify inventory items allows entering device data. In case ofmodifying, these fields will be filled with the current information to be edited.

Acrylic WiFi Professional - ©2016 – Tarlogic Security SL12

Packet viewer
Filters can be applied to receive packets for specific analysis, focusing on certain packets
and disregarding others.
These filters can be added from the filter text box, directly if the filter type to be appliedis known, or from the packet tree by right-clicking on the tree view to use the selected
item as a filter.
As text is entered in the filter text box, the filter is checked for validity. If the filter is valid,
the text box background will be displayed in green, or otherwise in red.

Filter examplesFilterResultShows
allpackets
ieee80211.management.beacon.exists
containing
a'beacon' fieldShows all thepackets with theieee80211.management.sa == 00:20:1F:1A:03:F1
specified origin
address
Shows all thepackets with a
ieee80211.management.sequencecontrol > 0x3400 control
sequence bigger
than 0x3400

SyntaxThe packet specifications and fields in the 802.11 protocol have been encapsulated in atree structure. You can access each one of these items through the field names separated
by dots ('.'). The protocol structure is shown by selecting a packet node from the Packettree view.
There are two root nodes to access the packet information:
Root node

ieee80211

Description
This is the default root node. All 802.11 protocol wirelessnetwork packets start with this node, which allows you toaccess the whole protocol through its fields. This can be verified
by clicking on a packet to see the Packet tree view
representation. These are some examples of fields that havebeen accessed through the root node: ieee80211.management
 ieee80211.control
 ieee80211.data

Acrylic WiFi Professional - ©2016 – Tarlogic Security SL13

Root node

Description
This root node allows access to additional data that has beenprocessed by the network card driver for each packet. This data
is not part of the transmitted packet, but it provides extra
information about it, such as receiving channel, signal strength,
RadioTapHeader etc.
Here's an example:
RadioTap.AntennaSignal > -50 <--- Packets thathave been received at a signal strength of -50dBm or stronger
This is a special node that allows direct access to theinformation elements of each packet when available. This way,
it is possible to set up a filter on an information element for any
type of packet. It would be otherwise required to set up all thepossible routes to the IEs for each type of packet.
Example:ies.ssid.ssid <--- Affects beacons and probes.

iesValid Operators
Operator==!=<><=>=%+*/
andorDescription
Equals Operator. It can be used with numeric and text fields.
Inequality Operator. It can be used with numeric and text fields.
Less than.
Great than.
Less than or equal.
Great than or equal.
ModuloPlus
Minus
Multiplication
Division
Logical AND.
Example: (ies.ssid.ssid == 'HACKERS_AHEAD') and(ieee80211.management.sequencecontrol > 0x3400)
Logical OR.
Example: (ies.ssid.ssid == 'HACKERS_AHEAD') or(ieee80211.management.sequencecontrol > 0x3400)

Types
Type

Description
Numeric values can be expressed as decimal or hexadecimal (beginning with
Number 0x).
Examples:Acrylic WiFi Professional - ©2016 – Tarlogic Security SL

14

Type

Text

Bytes

Description
 Decimal: ieee80211.management.sequencecontrol >13312
 Hexadecimal: ieee80211.management.sequencecontrol> 0x3400
Text can be expressed between simple quotation marks (').
Example: ies.ssid.ssid == '#FBI Surveillance Van #1'
Byte sequences can be expressed by concatenating hexadecimal bytes withcolons (:).
Examples: ieee80211.management.sa == 60:A4:4C:69:D2:48
 ieee80211.management.beacon.fixed ==85:71:83:07:00:00:00:00:64:00

Acrylic WiFi Professional - ©2016 – Tarlogic Security SL

15

Scripts
Script Editor
From this section, you can create and modify existing scripts, and also test them against
certain SSIDs/MACs to validate their passwords.
The scripts are programmed in C# language.

The script editor uses syntax highlighting to help the developer.
Scripts can be developed on other IDEs, such as Visual Studio, and they can be added toAcrylic Wi-Fi Professional.
Acrylic also has a script template. You can open the template by selecting New script on
the right side of the editor.
Acrylic Wi-Fi Professional scripts should always have a main class with the same name asthe file. This class should have the following properties:

Acrylic WiFi Professional - ©2016 – Tarlogic Security SL

16

// Script description
public string Description { get { return "DESCRIPTION"; } }// Script Version.
public double Version { get { return VERSION; } }// Script Author
public string Author { get { return "AUTHOR"; } }// Valid SSID’s
public List&lt;string&gt; ValidSsids { get { return new List&lt;string&gt; {"SSIDS" }; } }// Valid MAC’s
public List&lt;string&gt; ValidMacs { get { return null; } }// Estimated keys
public int EstimatedKeys { get { return 1; } }// SSID Security type
public SecurityParams Security { get { return SecurityParams.Wpa |SecurityParams.Wpa2; } }The main class should also have a Generate function that is called whenever a password
is required.
public List string Generate(List&lt;object&gt; keygenParams);

To make scripting easier, when you create a new script, a window requesting the main
details is displayed to help generate a script template, which will be ready to inject code
into the Generate function.
You will also be able to access the script editor's context menu by right clicking on theeditor.

Acrylic WiFi Professional - ©2016 – Tarlogic Security SL17Editor options

In the script testing section, you can specify the script test parameters to validate they
are working correctly. Access point, SSID, MAC and security type fields should becompleted in order to run the test. You need to specify whether you are testing
passwords or WPS PINs. Finally, you need to click on the Test button to star a new test.

Script list
All available scrips are listed under this section.
The scrips use public algorithms to generate passwords used on commercial Wi-Firouters.
These scripts are grouped into two different categories; the first one, on top, to generate
WPA1/WPA2 security protocol passwords, and the second one, at the bottom, togenerate WPS security standard PIN codes.

Acrylic WiFi Professional - ©2016 – Tarlogic Security SL18Column Name

What information gives?
SSIDs meeting the script's specified criteria.'?' is used as a wild-card
Supported SSID
character.
Supported
MAC Address meeting the script's specified criteria.
MACs
Supported
Only required for WPA1 and WPA2 network security protocols. ItSecurity
specifies the security type supported by the script.
Number of passwords generated by the script. In the best casePossibilities
scenario, its value would be 1, but there could be several possibilities.
VersionScript Version (Informative)
Description
Script Description (Informative)
AuthorScript Author (Informative)
Filename
Script Filename (Informative)
You can also interact with the listed scripts through the context menu that can beaccessed by right clicking on each script.

Acrylic WiFi Professional - ©2016 – Tarlogic Security SL19