Ok, welcome back. In our next section,
we will discuss the capturing of wireless traffic,
what you can do with Wireshark and how to analyze
wireless communications so that you can solve problems.
So with wireless, one of the interesting things
at least for our generations, current generation is that we moved from a
completely cable-based or wire-based network topology to
now more and more we see what we will call wireless
which is in the most simplistic generic terms
the use of radios to communicate on a network so that you do not need
the basic cable technology that you were using in the past.
This does not remove the need for cable.
What I will say is that you cannot at this time
achieve speed and efficiency that you can
through cable that you, through wireless that you could with cable.
As an example, I wouldn't set up a wireless backbone on my core network.
But I will say is, as years go on it is evolving more and more
and I could say at least at this point, most if not all clients deployed,
PC's deployed today have a wireless card in them
so, troubleshooting wireless network is
pretty much one of the things, as engineers and analysts,
we find ourselves doing very often.
So wireless technology built upon standards
from the I triple E 802.11 committee
and you have some basic standards such as A, B, G and N
that allow you to operate on different frequencies,
operate at different speeds, you have different antennas.
So there's certain things that you have to understand about wireless in general,
to be able to troubleshoot wireless technologies.
So that when you do capture them with Wireshark,
you have a bit of an understanding of what you're looking for.
For example, if you're going to troubleshoot
an SSID, you would need to know what a basic service set is
and understand what a service set identifier is, how all that works.
But if you hearken back to normal, or older types of networking,
basically you needed a domain for your clients to join that is similar to what an SSID is.
You need to associate and then authenticate to a wireless network.
And to do so, you need to do so by the SSID.
Troubleshooting with Wireshark, you are now able to by default, open up Wireshark.
It will find your wireless NIC. It will work with it to provide you capture information
so that you can do deep dives into the data to find issues.
There's AirPCap and there's other solutions that provide
those who deal with wireless on a day by day basis some more granular information.
However, with Wireshark out of the box, there's quite a few tools
that you can use to capture wireless data and start to analyze it.
So in this example, we see a simple capture of wireless data.
And I will pull this up on the Wireshark window.
And a couple of key things to notice is that by default
when you want to view the wireless toolbar, you'll have to turn it on.
And when you turn it on, you would be able to adjust it
so that you can view specific things such as channeling information.
In this toolbar as well, it allows you to set up a decryption key
so if you have, let's say, WEP and you want to decrypt that data,
you can add the ket in and it will work to decrypt the data for you.
Again another security issue that you may want to get permission so that you don't go against
the security policy for the client or the company that you're working for.
But essentially, when you're working within the capture, one of, couple of things
that you may want to isolate is exactly what's going on.
And in this example, we see excessive beaconing.
There's probably a wireless client attempting to join a wireless network.
This is one of the reasons why when you leave wireless on your computer,
your battery seems to drain out fairly quickly as well as your phone.
This constant connecting or trying to connect to things puts a strain on your device.
However, it is how the technology works.
So that's how it will find and allow you to connect to
a wireless station or an AP or a type of a
consolidator to let you associate and then authenticate into a wireless network.
So, problems you may encounter - common problems are
when it's excessively trying to connect,
you may have the incorrect SSID configured.
It may be hidden from you and therefore, you don't see it and you have to edit manually.
But if you can see them, you may have that configured incorrectly.
You may have the wrong key, the wrong incryption type.
For example, you may have settings that
do not match for WPA 2, TKIP and other.
You may have a channeling problem.
You may have overlapping channels from
2 networks that may be in a similar vicinity
and your milliwatt's too high and they're kind of stepping on each other.
You may have issue where you do not have correct coverage.
and you have spots on your network that do not have coverage.
You can use heat map to try to figure that out,
to see where you need to either adjust and increase milliwatts
or you need to provide an additional AP to have coverage.
And some of the tools that you can use to start digging into this data,
is specific to when you capture wireless data. Let me pull up the capture again.
When you go into your statistics menu,
you can pull up the wireless LAN traffic tool.
It will analyze the wireless LAN traffic and provide some information to you about it,
such as specifically, which SSID's are responding
and what networks they're connecting and
the data, amount of data that was sent, amount of data that was received,
probing and other information that may be relevant
to troubleshooting what the current issue may be.
So as you can see, there's a specialized toolbar.
There's a specialized tool, the wireless LAN traffic option
in the statistics menu that will allow you to do a deeper dive of wireless.
And specifically, in the capture itself, you can drill down into the data
and start looking at what's going on here.
So as an example here, we may have a beacon.
We may want to drill down and to check out the wireless LAN management frame
and see if we have specific parameters we need to check.
Maybe there's something configured incorrectly such as the SSID and so on.
So we can drill down into that data after we capture it within Wireshark.