{"id":461,"date":"2011-10-16T20:58:17","date_gmt":"2011-10-16T20:58:17","guid":{"rendered":"http:\/\/41j.com\/blog\/?p=461"},"modified":"2011-10-16T21:05:15","modified_gmt":"2011-10-16T21:05:15","slug":"securitytube-wireless-lan-security-megaprimer-notes-part-5","status":"publish","type":"post","link":"https:\/\/41j.com\/blog\/2011\/10\/securitytube-wireless-lan-security-megaprimer-notes-part-5\/","title":{"rendered":"SecurityTube, Wireless Lan Security Megaprimer notes: part 5 (Dissecting WLAN Headers)"},"content":{"rendered":"

Vivek’s video is here<\/a>.<\/p>\n

Basic Terminology<\/h2>\n

STA: Station (Wireless Client)<\/p>\n

BBS: Basic Services Set (AP and clients in infrastructure or Ad-Hoc Clients)
\n * Infrastructure BSS: Setup using Access point
\n * Independent BSS: Ad-Hoc network<\/p>\n

BSSID: Basic Service Set Identifier
\n * Infrastructure Mode: MAC address of AP
\n * Ad-hoc Mode: Randomly chosen address by first device. (IBSS)<\/p>\n

DS: Distribution System (connects APs in ESS).
\n * The LAN connecting APs together.<\/p>\n

ESS: Extended Service Set (set of BSSs)
\n * Basically everything (BSSs + DS)<\/p>\n

WLAN Packet Header<\/h2>\n

Looking at a beacon frame (could be any frame)<\/p>\n

0. Open a frame in wireshark
\n0.1 Take a look at the “Frame section”
\n * Contains meta information about the packet, received time etc.<\/p>\n

0.2 Take a look at the “Radiotap Header”
\n * Received from card
\n * Signal strength (Useful for intrusion detection, can be used to triangulate clients)
\n * Channel frequency etc.<\/p>\n

0.3 WLAN Headers, open “IEEE 802.11 Beacon Frame” section
\n * Frame type information (subtype)<\/p>\n

1. All WLAN Packets have the following fields:
\n * Frame Control (2 bytes)
\n * Duration\/ID (2 bytes)
\n * Address 1 (6 bytes)
\n * FCS (4 bytes) (Checksum)<\/p>\n

1.1 Frame Control:
\n * Bitfield containing a bunch of information:
\n * Protocol
\n * Default value 0, may change with major revision (currently always 0)<\/p>\n

* Type\/Subtype
\n * Type – Management, Control or Data frame
\n * Sub-types of each of these.<\/p>\n

* To DS and From DS
\n * Indicate where the packet is going:<\/p>\n\n\n\n\n\n\n\n<\/table>\n

* More frag: are more fragments of frame following (data and management only).
\n * Retry: Indicates that this frame is a retransmission (data and management only).<\/p>\n

* Power Management: Indicates if client is in power save mode or active mode. (power save e.g. battery)
\n * More Data: Indicates that there’s more data queued up to be sent.
\n * Protected frame: Indicates if frame body in encrypted or not.
\n * Order: Indicates that all frames must be processed in order.<\/p>\n

Check you can see all this in wireshark (Type and subtype are shown twice)<\/p>\n

1.2 Duration\/ID field
\n * Used to set “NAV” (Network Allocation Vector).
\n * NAV is the minimum time to wait before transmission
\n (tells other clients please wait this long for this packet transmission to complete)<\/p>\n

1.3 Address fields
\n * Depends on type\/sub-type (Source address, destination address, BSSID address)<\/p>\n

1.4 Sequence Control
\n * Sequence number of the packet AND Fragment number of the packet.<\/p>\n

Check you can see all this in wireshark!<\/p>\n

1.5 QoS (quality of service)…<\/p>\n

1.6 Frame body: The data payload
\n * management frame information
\n * data transmission<\/p>\n

1.7 FCS: CRC check over the MAC header and Frame body
\n * Easy to “fix” FCS if we modify the frame. <\/p>\n","protected":false},"excerpt":{"rendered":"

Vivek’s video is here. Basic Terminology STA: Station (Wireless Client) BBS: Basic Services Set (AP and clients in infrastructure or Ad-Hoc Clients) * Infrastructure BSS: Setup using Access point * Independent BSS: Ad-Hoc network BSSID: Basic Service Set Identifier * Infrastructure Mode: MAC address of AP * Ad-hoc Mode: Randomly chosen address by first device. […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[1],"tags":[14,13,12,10,11],"class_list":["post-461","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-pentest","tag-security","tag-securitytube","tag-wifi","tag-wifiprimer"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/p1RRoU-7r","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/41j.com\/blog\/wp-json\/wp\/v2\/posts\/461","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/41j.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/41j.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/41j.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/41j.com\/blog\/wp-json\/wp\/v2\/comments?post=461"}],"version-history":[{"count":6,"href":"https:\/\/41j.com\/blog\/wp-json\/wp\/v2\/posts\/461\/revisions"}],"predecessor-version":[{"id":467,"href":"https:\/\/41j.com\/blog\/wp-json\/wp\/v2\/posts\/461\/revisions\/467"}],"wp:attachment":[{"href":"https:\/\/41j.com\/blog\/wp-json\/wp\/v2\/media?parent=461"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/41j.com\/blog\/wp-json\/wp\/v2\/categories?post=461"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/41j.com\/blog\/wp-json\/wp\/v2\/tags?post=461"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

To DS<\/td>\nFrom DS<\/td>\nInfo<\/td>\n<\/tr>\n
0<\/td>\n0<\/td>\nSTA to STA in the same IBSS (ad-hoc) or management and control frame<\/td>\n<\/tr>\n
0<\/td>\n1<\/td>\nExiting the Distribution System (DS) (e.g. AP to client)<\/td>\n<\/tr>\n
1<\/td>\n0<\/td>\nEntering the DS (e.g. client to AP)<\/td>\n<\/tr>\n
1<\/td>\n1<\/td>\nUsed in Wireless Distribution System (WDS, e.g. extending Wifi network)<\/td>\n