Basic workshop
ofSharkFest'17 US
IEEE802.11 packet dissection
Sample trace and supplemental files are located

http://www.ikeriri.ne.jp/download/defcon

Megumi Takeshita
Packet Otaku | ikeriri network service co.,ltd

Please cooperate clearing the environments• Open Wireshark• Help > About Wireshark > Folder• Open link of Personal configuration• Clear files and copy the profile2

Megumi Takeshita, ikeriri network service
a.k.a. packet otaku••••

Founder, ikeriri network service co.,ltd
Wrote 10+ books of Wireshark and capturing andnetwork analysis.
Reseller of Riverbed Technology ( former CACEtechnologies ) and Metageek, Dualcomm etc. in Japan
Contributor to Wireshark projectex. translator of QT Wireshark into JapaneseWorkshop index ( 60 min )We play this workshop in offline ( no internet access )0. Live RF Demonstration (6 min)1. Collecting Wireless information using Windows (6 min)
2. Checking 2 types of physical layer (6 min)3. Picking up basic link-up process (10 min)4. Decrypting WPA2(PSK) (6 min)5. Troubleshooting (12 min)#1 my WiiU failed to connect AP (6 min)#2 Wi-Fi connection is down ? (6 min)
6. Inspecting suspicious packets. (6 min)

#0 Live RF Demonstration• Now I introduce the live wireless environment
at Packet Hacking Village, DEFCON 25, Vegas• At First it is good idea to collect RF signal at 2.4GHz
and 5GHz, including other waves except for Wi-Fi• We can know channel usage, and other wave without IEEE802.11• Now I test some devices that does not use Wi-Fi, but use 2.4GHz.
• Next collecting some important packet such as Deauthentication andDisassociation,• Using capture filter is the best way to capture the specified packet• Using AirPcap and dumpcap, you can collect only
Deauthentication/Disassociation
tshark -i 1 -f “subtype deauth or subtype disassoc"
5

#1 Collecting Wireless information using Windows• You want to collect Wi-Fi information• But you have just a Windows PC, no apps
• Please open command prompt and collect Wi-Fi information.
• You need to collect
Driver description / Driver version / Interface name / MAC address
SSID / BSSID / authentication/encryption / Channel / speed /signaland other AP’s information ( SSID / BSSID / Power / Authentication /encryption )• Hint “netsh”

6• “netsh wlan sh all | more “• Driver section
Driver name, version,
Physical types of Wi-Fi• Interface section
MAC Addressconnected or not connected
SSID / BSSID / network types
PHY / Channel / Speed / Power• Network mode = BSSID display section
SSID / authentication / encryption / BSSID / Power /Channel / Rate
• Use redirect and pipe
netsh wlan sh all | find “BSSID“ > BSSID.txt
netsh wlan sh all | find “SSID” > SSIDandBSSID.txt
7#2 Checking 2 types of physical layer (6 min)• Let`s open 2 trace files that contains same ICMP request/response“2-radiotap-icmp.pcapng” and “2-ppi-icmp.pcapng”• please compare two packets especially at physical layer header,Radiotap header and Per Packet Information header

8TypeRadiotap header

PPI header

PacketWe can capture wireless frames as 2 kinds of frame
format in Physical layer using AirPcap and Wireshark9

TypeGOOD

BAD

Radiotap• Easy to read, simple• Fixed format• Easy filter
radiotap.dbm_antsignal• Cannot collect multiple
anntena information••PPI• Extensible format
future info 11ac, etc• Includes multiple
antenna information• Hard to read, complex• Long filter
ppi.80211n-macphy.dbmant0.signal

RECOMMEND Radiotap in 11a/b/g/n(20MHz)
Demonstration Wireless toolbar> setting10

#3 Picking up basic link-up process• My Nintendo WiiU connect AP that SSID is “DEFCON” at 1ch (2412MHz)• Now we open trace file “3-WiiU.pcapng”,
filter using Wireshark display filter,mark the connection ( Ctrl + M ),export specified packet as another trace file.
“linkup.pcapng”• You think there are tons of other packets in trace file.
• You do not have to mark “ACK” packet ( sometimes sender is blank )• It is usual in wireless packet capturing, so display filter is important• Hint: the link-up process ends in a seconds,
so you find some important packet, you can find the other packet at near time.
11

The link-up process of Wi-Fi (WPA2 AES-PSK)
StationAPbeaconProbe request and response
Authentication x 2
Association Request and response
EAPOL 4 way handshake
Data communication

You need to mark 10 more packets including
1: Beacon from AP2: Probe Request from STA / Response from AP
3: Authentication from STA and from AP
4: Association Request from STA / Response from AP
5: EAPOL 4 way handshake ( 4 message )6: some data packets
Hint 0 all packet is captured at 1ch• Hint 1 My WiiU mac address
wlan.addr eq 9c:e6:35:35:63:78• Hint 2: My AP mac address (BSSID)
wlan.addr eq 00:1d:93:a8:55:d8
12• Hint 3: You can refer display filter list.

Frame TypeExplanation

Management
wlan.fc.type==0Beacon wlan.fc.type_subtype==8Probe request wlan.fc.type_subtype==4Probe Response wlan.fc.type_subtype==5Association Request wlan.fc.type_subtype==０
Association Response wlan.fc.type_subtype==1
Authentication wlan.fc.type_subtype==11Controlwlan.fc.type==1

Deauthentication wlan.fc.type_subtype==12
Disassociation wlan.fc.type_subtype==10
RTS (Request To Send) wlan.fc.type_subtype==27
CTS (Clear To Send) wlan.fc.type_subtype==28
ACK (ACKnowledge) wlan.fc.type_subtype==29

Datawlan.fc.type==2wlan.fc.type_type==2
Null data wlan.fc.type_subtype==36

13

Pick up and mark packet• Mark Beacon
Filter packets using type_subtype of Beacon (8) of IEEE802.11 frame,wlan.fc.type_subtype==8, then search packet that SSID is defcon• Mark connection
Filter packets using STA MAC address wlan.addr == 9c:e6:35:35:63:78,
next look for association response, then you can find entire connection processnear here in a seconds ( beacon, probe, auth, assoc, eapol, data)• File > Export specified packets and select marked packets button to export theanother trace file such as 3-wiiulinkup.pcapng• Note you may not have to collect ACK, and collect all 4 way handshake packets.

3-wiiulinkup.pcapng

#4 Decrypting WPA2
• Open 4-wiiulinkup.pcapng ( same as last trace file we filtered )• Please look at data frame using display filter ( wlan.fc.type==2 )• You can find all data section is encrypted by WPA2(AES-PSK)
but you capture all 4 way handshake message ( eapol )• Select some data packet and click IEEE802.11 header, right click> protocol preferences > Open IEEE802.11 wirelss LAN preferences…

16

#4 Decrypting WPA2
• Confirm Enable decryption is checked• Select Edit button of Decryption Keys
• Push “+” button, and select wpa-pwd
in Key type, then input the PSK:SSIDdefcon25:defcon• Note: You must collect all 4 messageof EAPOL 4 way handshake, because
it contains information of creating
PTK(pairwise transient key )such as nonce, MAC, SSID, etc.
17Please check the trace file is decrypted#5 Troubleshooting #1 my WiiU failed to connect AP• Open trace 5-troubleshooting1.pcapng• My WiiU (9c:e6:35:35:63:78 )failed to connect AP (00:1d:93:a8:55:d8)• Why ? Please look for the reason• Hint1: Filter packets by STA mac address• Hint2: Look in detail in IEEE802.11 frame

19Invalid AKMP ( Specification mismatch between STA and AP )• Invalid AKMP (0x002b) in Fixed parameters, IEEE802.11 Association
response frame from AP, it means mismatch of IEEE802.1x setting
AKMP : IEEE 802.1X Authentication and Key Management Protocol).

20

#5 Troubleshooting #2 Wi-Fi connection is down ?
• Open trace 5-troubleshooting2.pcapng• I fixed the AP setting and try again• My WiiU (9c:e6:35:35:63:78 )failed to connect AP (00:1d:93:a8:55:d8) Wi-Fi connection is down ?
• Why ? Please look for the reason• Hint1: Look for stack point• Hint2: Repetition of the packet
implies some trouble

21Pre-Shared-Key mismatch• Datalink layer is up because you can find association response,• But EAPOL 4 way handshake is failed between message 2 and 3.
then AP sends Disassociate frame to STA• Message 2 of 4 way handshake sends Nonce, MIC (Hash), MAC
address ( then creates PTK off-line )• Message 3 is not sent because calculated PTK is not the same22

#6 Inspecting suspicious packets• Open trace 6-inspectingsuspiciouspackets.pcapng• What is the problem ?
• Which device is the cause of the issue ?
• Hint1 Use the wireless statistics• Hint2 Look for repetition of the packet• Hint3 the interval of Association Request

23

Find Abnormal traffic using wireless LAN traffic• Wireless > Wireless LAN traffic show you the statistics of wirelesspackets, and the trend of the traffic• Please refer the abnormal packets of Deauthentication.
• Select the address and right click and filter the packets.

24

Reaver attack to brute force crack WPA Password• Please check reason code of Deauthentication frame
filter deauth ( wlan.fc.type_subtype ==12 )• Many Deauthentication frames in a seconds, it is a symptom of attack,Reaver that exploits a security hole in wireless routers using WPS bruteforce attack. But now many routers are patched and protected, and WPS
tend to be disabled.
25

Thank you