Wireshark 101: Wireless Sniffing; Haktip 139 Video Lecture | Start Using Wireshark: Do Hacking like a Pro - Back-End Programming

this hack tip is brought to you by the
all-new G flex 2 from LG life's good
welcome to hack tip the show will we
break down concepts tools and techniques
for hackers gurus and IT ninjas I'm
Shannon Morse and today we are checking
out Wireshark and wireless packet
captures now wireless works a little bit
differently than wired networks I'm not
going to show you an example just yet in
Wireshark because first I want to
explain what wireless spectrum looks
like so the physical layer of a wireless
spectrum has 11 different channels in
the US legally your network data in
traffic will show up on one of those
different channels therefore you have to
configure your computer to know which
channel to capture track it traffic on
in Wireshark you may want into any kind
of wireless interference if you're in a
warehouse for example you might have
Wireless interference there and that
might give you some false packet loss
data which you need to know about
beforehand and you might end up with
capturing data from an overlapping
Channel if you have two different
channels with tons of different wireless
routers going on both of them at the
same time you should also know about
wireless card modes so there are six six
main modes that you can choose from
there's managed ad-hoc master mesh
repeater and monitor monitors the one
that we're going to pay most of our of
our attention to but I'll go ahead and
explain in just a little bit so master
mode is often referred to as an access
point or a base station interfaces in
managed Mon a to a k8 infrastructure
mode are considered clients or stations
that are the devices connected to the
access point that would be like your
laptop ad hoc a hate AKA peer-to-peer is
a mode where wireless devices can
communicate with each other without the
need for a centralized base station or
an access point a wireless interface and
repeater mode can be configured to
connect to a wireless network or repeat
the signal so that would be like a
wireless repeater now you can think of a
mesh as a sort of planned ad hoc network
mesh networks or mesh clouds our radios
are comprised of radios acting as
routers gateways and clients and lastly
is the
one that I mentioned monitor mode so
this lets your wireless device listen to
the packets flying through the airways
no transmitting or receiving just
monitoring so there are a lot more
details about all these different ones
in hack tip episode 9 by Darren kitchen
to capture traffic in monitor mode on on
a Windows machine for example you will
most likely need to use Hardware such as
air P cap which you can find over at
riverbed comm and we also sell one over
in the hack shop which works just as
well this is called the AWU s 0 3 6 and
e h alpha USB Wi-Fi device so both of
these can you monitor modes and it's
very very important to use these with a
Windows computer so after this you would
need these to use win P cap drivers this
will add monitor mode to your computer
if you're using a Linux machine you can
probably just change the NIC internally
this varies depending on your own
wireless hardware so do a quick search
on google for your specific device
moving on now let's take a look at
Wireshark with wireless packet headers
so first off I wanted to show you a very
very simple one this one has a new
section for 802 11 and we've never seen
that before 802 11 down here in an
actual packet and this one in particular
has this thing called a beacon frame or
delicious bacon so a management frame
like this one establishes connectivity a
control packet would allow the
management and data packets to be
delivered and a data packet contains the
actual data so this management packet in
particular is this bacon frame ok its
beacon sorry but I'm really hungry I
love bacon which broadcasts from a W AP
or a wireless access point out to pretty
much anyone listening within that area
so you'll find the type in the sub type
in the header as well as a timestamp so
I can look down here so you can find the
type and subtype so in this case it
would be management frame as well as a
timestamp which is down here and I will
also see the beacon interval which is
retransmissions of beacons and that's
going to show me how
many times in seconds that they will be
transferred capability information will
be below that and you'll need to look up
with each of their numbers mean and then
you'll have the SSID the supported rates
specifically the data transfer rates and
the D S parameter which is actually the
channel of the W AP so if we look down
here and find our D s parameter the
current channel is going to be 11 how
interesting
now next week I'm going to delve into a
lot more information about wireless
networks and how to use those with
Wireshark but first off I'm going to go
ahead and wrap it up let me know what
you think send me a comment below or
email us tips at hak5 org be sure to
check out our sister show hak5 org hak5
for more great stuff just like that I'll
be there reminding you to trust your
technical list
this hack tip is brought to you by the
all-new G flex 2 from LG life's good