Question

In this lab, we’ll investigate the 802.11 wireless network protocol. Follow the instructions and answers questions 7 - 10.

http://gaia.cs.umass.edu/wireshark-labs/wireshark-traces.zip

In this lab, we'll investigate the 802.11 wireless network protocol. Before beginning this lab, you might want to re-read Section 6.3 in the text. Since we l1 be delving a bit deeper into 802.11 than is covered in the text, you might want to check out "A Technical Tutorial on the 802.11Protocol," by Pablo Brenner (Breezecom Communications) http://www.sss-mag.com/pdf802_11tut.pdf, and "Understanding 802.11 Frame Types," by Jim Geier, http://www.wi-fiplanet.com/tutorials/article.php/1447501. And, of course there is the "bible" of 802.11 - the standard itself, "ANSI/EEE Std 802.11, 1999 Edition (R2003)." http://gaia.cs.umass.edu/wireshark-labs/802.11-1999.pdf. In particular, you may find Table 1 on page 36 of the standard particularly useful when looking through the wireless trace In all of the Wireshark labs thus far, we've captured frames on a wired Ethernet connection. Here, since 802.11 is a wireless link-layer protocol, we'll be capturing frames "in the air." Unfortunately, many device drivers for wireless 802.11 NICs don't provide the hooks to capture/copy received 802.11 frames for use in Wireshark (see Figure 1 irn Lab 1 for an overview of packet capture). Thus, in this lab, we'l1 provide a trace of captured 802.11 frames for you to analyze and assume in the questions below that you are using this trace. If you're able to capture 802.11 frames using your version of Wireshark, you're welcome to do so. Additionally, if you're really into frame capture, you can buy a small USB device, AirPcap, http://www.cacetech.com, that captures 802.11 frames and provides integrated support for Wireshark. 1. Getting Started Download the zip file http://gaia csumassedu/wireshark-labs/wireshark-traces zip and extract the file Wireshark 802 11.pcap. This trace was collected using AirPcap and Wireshark running on a computer in the home network of one of the authors, consisting

Answer 1

Answer 7
*********
The TCP SYN is sent at t = 24.811093 seconds into the trace. The MAC address for the host sending the TCP SYN is 00:13:02:d1:b6:4f.

The MAC address for the destination, which the first hop router to which the host is connected, is 00:16:b6:f4:eb:a8. The MAC address for the BSS is 00:16:b6:f7:1d:51.

The IP address of the host sending the TCP SYN is 192.168.1.109. Note that this is a NATed address. The destination address is 128.199.245.12. This corresponds to the server gaia.cs.umass.edu. It is important to understand that the destination MAC address of the frame containing the SYN, is different from the destination IP address of the IP packet contained within this frame. Make sure you understand this distinction.

Wireshark 802 11.pcap File Edit View Go Capture Analyze Statistics Telephony Wireless Tools Help fiter.. <Ctrl Expression+ No. Time Source Destination Protocol Length TOP Segment Len Info Intelcor_d1:b6:4f (. 802.11 Acknowledgement, Flags- Fragmented IEEE 802.11 frame Acknowledgement, Flags- Standard query 8x7892 A gaia.cs.umass.edu Acknowledgement, Flags- Standard query response 8x7892 A gaia.cs.umass.edu A 128.119.245.12 Acknowled 467 24.792 468 24.795 cisco-Li f7:1d:51 Cisco-Li_f4:eb:e8 82.11 9e 469 24.795 470 24.795 192.168.1.189 471 24.795 472 24.889 68.87.71.226 473 24.889 474 24.811 192.168.1.189 38 Cisco-Li-f7:1d :51 (” 802.11 38 68.87.71.226 Intelcor_d1:b6:4f (. 802.11 38 192.168.1.189 Cisco-Li f7:1d:51 (.. 802.11 128.119.245.12 DNS 125 DNS 141 TCP 0 2538B8 [SYN Seq-0 Win 16384 Len-8 MSS-1468 SACK PERM-1 [SYN, ACK] Ack-1 Itin-5848 476 24.827 128.119.245.12 477 24.827 478 24.828 192.168.1.189 479 24.828 480 24. 828 192. 168。1. 109 192.168.1.189 Cisco-Li f7:1d:51 ( 802.11 38 128.119.245.12 Intelcor_d1:b6:4f (. 802.11 38 128.119.245.12 110 0 80 Acknowledgement, Flags- 2538 Seq-0 Len-e SACK-PERM-1 → 0 2538 → 88 [ACK) Seqs1 Ack-1 win-17520 Len-e TCP 182 Acknowledgement, Flags- 435 GET /wireshark-labs/alice.txt HTTP/1.1 HTTP 537 Frame 474: 110 bytes on wire (880 bits) 110 bytes captured (880 bits) Radiotap Header ve, Length 24 802.11 radio information IEEE 882.11 QoS Data, Flags: . . ..TO Type/Subtype: QoS Data (ex0028) Frame Control Field: 0x8801 Receiver address: Cisco-Lif7:ld:51 (e0:16:b6:f7:1d:51) Transmitter address: IntelCor_d1:b6:4f (e:13:02:d1:b6:4f) Destination address: Cisco-Li f4:eb:8 (88:16:b6:f4:eb:a8) Source address: Intelcor_d1:b6:4f (00:13:82:d1:b6:4f) 000 00 00 18 00 ee 58 80 00 1 60 85 89 ce 00 da 9c 0010 60 00 00 3e ee fc 57 ad 88012c00 ee 16 b6 f7 、..>..w.. 828 1d 51 030 00 00 a 03 00 00 00 08 00 45 00 00 30 13 24 . - 840 40 00 80 06 be a c0 a8 01 6d 80 77 f5 ec 09 ea 5 e 50 71 af cd 46 e ee 00 70 82 48 00 c2 55 P FpU ee 16 b6 f4 eb a8 10 e3 0 13 02 d1 b6 4 Source Hardware Address (wlan.sa), 6 bytes Packets: 2364-Displayed: 2364 (100.0%) Profie: Default 9:25 PM U: 2.5 K 04/05/2019 5

Answer 8
*********
The TCP SYNACK is received at t = 24.827751 seconds into the trace. The MAC address for the sender of the 802.11 frame containing the TCP SYNACK segment is 00:16:b6:f4:eb:a8, which is the 1st hop router to which the host is attached .

The MAC address for the destination, which the host itself, is 91:2a:b0:49:b6:4f. The MAC address for the BSS is 00:16:b6:f7:1d:51. The IP address of the server sending the TCP SYNACK is 128.199.245.12

Wireshark 802 11pcap File Edit View GoCapture Analyze Statistics Telephony Wireless Tools Help Ltcp.stream eq0 No. Expression+ Time Source Destination 128.119.245.12 192.168.1.189 128.119.245.12 128.119.245.12 192.168.1.109 Protocol Length TCP Segment Len Info 80 [SYN] 2538 [SYN, [ACK] Seque ผ1n,16384 Lente MSs-1460 SACK-PERI-1 ACK] Seq-0 Ack-1 win-5848 Len-e SACK-PERM-1 Seq-1 0 2538 0 80 → 474 24.811 192.168.1.189 476 24.827 128.119.245.12 478 24.828 192.168.1.109 480 24.828 192.168.1.189 482 24.846 128.119.245.12 484 24.847 486 24.848 128.119.245.12 488 24.850 128.119.245.12 489 24.850 128.119.245.12 490 24.851 128.119.245.12 492 24.851 128.119.245.12 494 24.851 192.168.1.109 495 24.852 192.168.1.189 497 24.852 128.119.245.12 118 118 182 537 188 TCP TCP HTTP TCP 2538 → 88 Ack-1 win-17520 Len-9 435 GET /wireshark-labs/alice.txt HTTP/1.1 0 80 2538 [ACK] Seq-i Ack 436 Win-6432 Len-e 313 802538 [PSH, ACK] Seq-1 Ack-436 Win-6432 Len-313 [TCP segnent of a reassembled POU] 1468 882538 [ACK] Seq 314 Ack-436 Win-6432 Len-1460 TCP segment of a reassembled PDU] 192.168.1.189 192.168.1.189 TCP TCP 415 1562 1562 1468 [TCP Retransmission] 88 2538 [ACK] Seq-314 Ack 436 Win-6432 Len-1468 1460 [TCP Retransmission] 88 2538 [ACK] Seq-314 Ack-436 Win-6432 Len-1460 1468「TCP Retransmission] 88 → 2538 [ACKİ Seq-314 Ack-436 win-6432 Len-1460 192.168.1.189 192.168.1.189 128.119.245.12 128.119.245.12 192.168.1.18g TCP TCP 2538B [ACK] Seq 436 Ack-1774 Win-17520 Len-i8 0 [TCP Dup ACK 494#1] 2538 80 [ACK] Seq:436 Ack:1774 11ins]7529 Len-e 182 1460「TCP Spurious Retransmission] 80 + 2538 「ACKİ Seg-314 Ack-436 win-6432 Len-1460 「TCP segment of a Frame 504: 1562 bytes on wire (12496 bits), 1562 bytes captured (12496 bits) Radiotap Header ve, Length 24 802.11 radio information IEEE 882.11 QoS Data, Flags: . .F.0 Type/Subtype: QoS Data (ex0028) Frame Control Field: 0x8802 00e 00e0 0010 1800-Duration: 4 microseconds Receiver address: Intelcor_d1:b6:4f (e0:13:02:d1: b6:4f) Transmitter address: Cisco-Li_f7:1d:51 (e:16:b6:f7:1d:51) Destination address: IntelCor d1:b6:4 (88:13:02:d1:b6:4f) Source address: Cisco-Li f4:eb:a8 (00:16:b6:f4:eb:a8) 8820 b6 4f 80 16 b6 f7 1d 51 80 16 b6 f4 eb a8 a0 C3 030 00 08 aa aa 03 00 00 0 08 00 45 00 05 de 17 el 848 48 00 31 86 f4 al 80 77 f5 c c a8 81 6d 0e 5 50 09 ca ae 8f ea cl 71 af ce fa 50 10 19 20 a3 4 0 60 00 00 0070 0088 O 1 m-P s ve ry like 77 61 73 20 76 65 72 79 20 6c 69 6b 65 6 9 d 0a 74 72 75 65 2e 29 0d 0a ed 0a 28 20 44 f 77 6e 2c 28 64 6f 77 6e 2c 20 64 6f 77 6e 2 0 28 57 6f 7S 6c 64 20 74 68 65 20 66 61 6c 6 wn, dow n, down Would the fal Profile: Default Source Hardware Address (wan-sa), 6 bytes Packets: 2364-Displayed: 230(9.7%) 04/05/2019 5

Answer 9
***********
At t = 49.583615 a DHCP release is sent by the host to the DHCP server (whose IP address is 192.168.1.1) in the network that the host is leaving. At t = 49.609617, the host sends a DEAUTHENTICATION frame (Frametype = 00 [Management], subframe type = 12[Deauthentication]). One might have expected to see a DISASSOCIATION request to have been sent.

Wireshark 802 11.pcap File Edit View Go Capture Analyze Statistics Telephony Wireless Tools Help fiter.. <Ctrl Expression+ No. Time Source Destination Protocol Length TOP Segment Len Info 1727 49.429 Intelcor d1:b6:4f isco-Li f7:1d:51 802.11 54 1728 49.430 1729 49.440 Cisco-Li f7:1d:51 Broadcast 1730 49.448 IntelCor_d1:b6:4 Cisco-Li f7:1d:51 882.11 1731 49.448 oS Null function (No data), SN-1603, FN-0, Flags- TC IntelCor dl:b6:4f ( 802.11 38 802.11 183 54 Intelcor_d1:b6:4f (. 802.11 38 Beacon frame, SN-3587, FN-0, Fla QoS Null function (No data), SN-1684, FN-0, Flags= C, BI-100, SSID-30 Munroe St P TC BI-18e, SSID-30 Nunroe St IntelCor_d1:b6:4f 882.11 38 Acknowledgement, Flags- 1734 49.583 1735 49.689 Intelcor d1:b6:4f Cisco-Li f7:1d:51 82.11 1736 49.689 1737 49.614 IntelCor d1:b6:4f 1738 49.615 1739 49.617 1740 49.638 Intelcor d1:b6:4f Cisco-Li f5:ba:bb 02.11 SN=1685, FN=0, Flags 54 IntelCor dl:b6:4f ( 802.11 38 Broadcast Cisco-Li f5:ba:bb (882.11 Cisco-Li-f5 : ba : bb ( 802.11 802.11 Probe Request, SN-1606, FN-, Flags- Acknowledgement, Flags- Acknowledgement, Flags- Authentication, SN-1606, FN-0, Flags- ...C, SSID-linksys_SES_24086 38 38 58 Frame 1733: 390 bytes on wire (3120 bits), 390 bytes captured (3128 bits) Radiotap Header ve, Length 24 802.11 radio information IEEE 882.11 QoS Data, Flags: . . ..TO Type/Subtype: QoS Data (ex0028) Frame Control Field: 0x8801 000 0000 0010 1100 Duration: 44 microseconds Receiver address: Cisco-Lif7:ld:51 (e0:16:b6:f7:1d:51) Transmitter address: IntelCor_d1:b6:4f (e:13:02:d1:b6:4f) Destination address: Cisco-Li f4:eb:8 (88:16:b6:f4:eb:a8) Source address: Intelcor_di:b6:4f (e:13:82:d1:b6:4f) 820 1d 51 830 8e 00 aa aa 03 00 08 e0 e8 00 45 0 e1 48 14 1c 0848 00 00 80 11 al ca c0 a8 81 6d c0 aB 81 01 60 44 850 00 43 01 34 Se d8 01 91 06 00 0e a5 a5 26 04 0 C-4 860 80 00 c0 a8 01 6d 0e e 0 00 00 00 0 00 00 e0 870 0e 00 0 13 02 d1 b6 4f e 00 00 00 00 00 00 00 088 8e 0 00 00 00 00 00 0e0 e0 00 8 00 0e 80 00 00 090 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 02 d1 b6 4 00 16 b6 f4 eb a8 80 eb E H Source Hardware Address (wlan.sa), 6 bytes Packets: 2364-Displayed: 2364 (100.0%) Profie: Default ENG 22 PM U: 4.7 K 04/05/2019 5

Answer 10
*************
The first AUTHENTICATION from the host to the AP is at t = 49.638857.

Wireshark 802 11.pcap File Edit View Go Capture Analyze Statistics Telephony Wireless Tools Help fiter. <Ctrl Expression+ Time Source Destination Protocol Length TOP Segment Len Info 1730 49.448 Intelcor d1:b6:4f isco-Li f7:1d:51 802.11 54 1731 49.440 1732 49.542 Cisco-Li f7:1d:51 Broadcast 1733 49.583 192.168.1.189 1734 49.583 1735 49.689 IntelCor d1:b6 :4f Cisco-Lǐ f7:1d: 51 802.11 1736 49.609 1737 49.614 IntelCor d1:b6:4f Broadcast 1738 49-615 Null function (No data), Flags-...P QoS SN:1684, FN=0, TC IntelCor dl:b6:4f ( 802.11 38 802.11 183 Beacon frame, SN-3588, FN-0, Fla DHCP Release Transaction ID exea5a526 Acknowledgement, Flags- C, BI-100, SSID-30 Munroe St 08s- 192.168.1.1 Intelcor_d1:b6:4f (. 802.11 38 IntelCor_d1:b6:4f ( 802.11 38 cisco-Lǐf5 : ba : bb (-802.11 38 Acknowledgement, Flags- Probe Request, SN-1686, FN-e, Flags- Acknowledgement, Flags- Acknowledgement, Flags Authentication, SIに1606, FNA, Flags 802.11 C, SSID-linksys SES 24886 Cisco-Li f5:ba:bb Cisco-Li f5:ba:bb 49.617 1740 49.638 IntelCor d1:b6:4 802.11 a8s Flags IntelCor-d1:b6 :4f Cisco-Li-f5 : ba : bb Cisco-Li fs:ba:bb ( Authentication, SN:1606, Acknowledgement 1742 1743 49.640 49.641 802.11 FN-, R C 802.11 38 , Flags- Frame 1740: 58 bytes on wire (464 bits), 58 bytes captured (464 bits) Radiotap Header ve, Length 24 802.11 radio information IEEE 882.11 Authentication, Flags: IEEE 802.11 wireless LAN . .C Fixed paraneters (6 bytes) 000 00 00 18 00 ee 58 00 0e 1 02 85 e9 ae 0 e7 9c 0010 64 00 00 4b 4c 37 30 ed be 00 3a el ee 18 39 f5 8820 ba bb 830 00 00 01 00 0e 00 4c 37 30 ed d -KL70, ..:..-9. ee 18 39 f5 ba bb 6064 0 13 02 d1 b6 4 .. Source Hardware Address (wlan.sa), 6 bytes Packets: 2364-Displayed: 2364 (100.0%) Profie: Default ENG 23 PM U:3.1 K 04/05/2019 5

if you have any doubt then please ask me without any hesitation in the comment section below , if you like my answer then please thumbs up for the answer , before giving thumbs down please discuss the question it may possible that we may understand the question different way and we can edit and change the answers if you argue, thanks :)