![\"\"](\"https:\/\/www.airxperts.net\/wp-content\/uploads\/2018\/07\/icon-zip-file-150x150.png\"){kind=icon}
<\/a><\/p>\nWireshark<\/h4>\n
Even if you’re an avid user of some of the premium packet analysis tools out there, such as Savvius’ excellent Omnipeek<\/a>, every so often most people will be opening up the free\u00a0Wireshark<\/a> to look at a capture.<\/p>\n Unfortunately the default view included with Wireshark is very poorly suited to 802.11 packet analysis:<\/p>\n <\/p>\n The classic view is no better:<\/p>\n The problem is that WiFi frame headers are different and far more variable than typical ethernet frames. And two-way communication is, in general, far more complex.<\/p>\n These are heavily geared towards Ethernet and TCP\/IP, which usually have single source and destination pairs.<\/p>\n In 802.3 ethernet addresses, we typically only have a source and destination MAC address, and sometimes a VLAN ID to be concerned with. Of course more complex protocols and encapsulations exist, but the standard ethernet address fields do not vary much. And the default wireshark views work fine.<\/p>\n In WiFi however, we have five “MAC” addresses to content with:<\/p>\n Moreover, not all of these addresses are present in each of the fundamental frame types and sub-types. Take acknowledgement frames for example. These only<\/em> contain an RA. The frame to which the Ack refers is implied by it’s timing<\/em>. Wireshark would require a some fancy programming to link the two and adjust the display. For example, to show unacknowledged data frames in a different colour. Further, Wireshark places the RA in an Ack in the Destination<\/em> column by default, which is misleading when looking at thousands of packets.<\/p>\n It doesn’t stop there. To analyse all the elements of a WiFi conversation is complicated. It’s not a simple exchange between two nodes, so we can’t simply follow a source and destination pair, or even high-layer information such as TCP\/UDP source and destination ports. We have to look at several different elements of a frame, their timing and the context.<\/p>\n Essentially, it’s After putting up with this for years I recently had a good opportunity to put some focus on this problem and attempt to solve it – or at least improve the situation.<\/p>\n A fully-fledged solution would involve a state machine<\/em>. But a workable solution using only visual cues turned it to be pretty simple. Recent versions of Wireshark (and perhaps ancient ones?) offer this feature. Basically most aspects of the display can be saved in a profile, and switched between on the fly, based on the type of capture you’re looking at.<\/p>\n Configuration Profiles save a whole range of options, but the ones that seemed the most helpful for this challenge were:<\/p>\n You’ll find Configuration Profiles<\/em> under the edit menu:<\/p>\n This menu item brings up the following dialogue, and this is how you define a new profile. But you can more easily switch profiles by clicking in the very bottom-right corner of the main Wireshark screen.<\/p>\n <\/p>\n We’ve already mentioned default and classic profile. Next I’ll take you through the 802.11<\/em> profile I created.<\/p>\n Before I do, here’s a sneak peak at how it ended up.<\/p>\n With screen real estate at a premium, I couldn’t fit in every field I wanted to. But the 5 basic addresses and ESSID were a must. The columns I settled on were:<\/p>\n A couple of potentially useful fields, like the Frame Control Field Flags (say that 10 times fast), were not included. This is because Wireshark did not want to display a nice simple ‘R’ for a retransmits, for example. Instead it prints a long and unwieldy sentence. Luckily flags are<\/em> already displayed in the Info<\/em> column so I decided I could live without this.<\/p>\n Here are the final column definitions:<\/p>\n In some ways c<\/span>o<\/span>l<\/span>o<\/span>u<\/span>r<\/span><\/strong> is the most important element to facilitate easy interpretation. Our brains are already optimised for it. I aimed for something as simple and subtle as possible. Background colour is the first big clue:<\/p>\n Next, we can use the text\/foreground colour for some more fine-grained information. I didn’t want to identify every single frame sub-type, just the key ones. Too much colour information would only make interpretation harder<\/em>. But Acks needed their own colour, as did beacons. Most other types shared a text colour:<\/p>\n Here is the final rule set:<\/p>\n These two changes already made interpreting Wi-Fi captures a lot easier.<\/p>\n For a bit of icing on the cake – or as @WazzFi might say, a bit of Kale on the Vegie Burger,\u00a0<\/em>filter buttons offer a quick way to filter your capture without having to use Wireshark’s display filter syntax.<\/p>\n I picked a few of the common filters I might regularly use:<\/p>\n Here are the final definitions:<\/p>\n And the buttons shown up next to the filter bar:<\/p>\n So far this scheme has worked out well, and my packet analysis using Wireshark has definitely been streamlined.<\/p>\n It’s easy to learn the obvious visual patterns, such as:<\/p>\n I’m particularly happy with the filter buttons. Being able to instantly drill down to client association and then flick back to see the broader context of those packets seems to save a bunch<\/em> of time.<\/p>\n I’ve made my configuration profile available for download at the bottom of this post.<\/p>\n It’s very simple to install. You’ll notice at the bottom of the Configuration Profiles dialogue, Wireshark display the path on your system. Simply download the file and unzip to this directory. The folder name is the profile name.<\/p>\n It’s worth noting that Wireshark will decrypt frames encrypted with a pre-shared key, provided you have also captured the 4-way handshake. A caution though – when you add a password it’s stored in cleartext<\/span> <\/strong>in a file in the current Configuration Profile directory. Be mindful of the security implications.<\/p>\n Another newish feature of Wireshark is the Wireless Toolbar<\/em>. This seems to be mainly oriented towards capturing <\/em>rather than display\u00a0– something I at least don’t do with Wireshark (thank you @adriangranados and Airtool<\/a>).<\/p>\n Unfortunately, if you do enable this toolbar, it is not saved with the profile and disappears on each new instance of the program. However, it does<\/em> provide a handy way to quickly access the 802.11 preferences dialogue. Typically you have to open Preferences<\/em> scroll through a long list of protocols, as shown below:<\/p>\n This screen is also where you setup decryption, so worth knowing this shortcut.<\/p>\n A last tip, after you switch profiles, hit Ctl-Shift-R<\/em> & Ctl-Shift-W<\/em> to reset the layout for the new profile (\u2318-Shift-R,\u00a0\u2318-Shift-W<\/em> for Mac).<\/p>\n Download the profile here and let me know your thoughts and suggestions below or on twitter! Of course you might want to customise a few things like the colours to your own tastes.<\/p>\n <\/p>\n![\"\"](\"https:\/\/www.airxperts.net\/wp-content\/uploads\/2018\/07\/thumb-view-default.png\")
<\/a><\/p>\n![\"\"](\"https:\/\/www.airxperts.net\/wp-content\/uploads\/2018\/07\/thumb-view-classic.png\")
<\/a><\/h4>\nThe Problem<\/h4>\n
Default Views<\/h5>\n
Addressing<\/h5>\n
\n
Other Fields<\/h5>\n
The Bottom Line<\/h5>\n
impossible<\/del>\u00a0very difficult to follow and interpret WiFi communications effectively using the default views.<\/p>\nThe Solution<\/h4>\n
Configuration Profiles<\/h5>\n
\n
![\"\"](\"https:\/\/www.airxperts.net\/wp-content\/uploads\/2018\/07\/thumb-menu-edit.png\")
<\/a><\/p>\n![\"\"](\"https:\/\/www.airxperts.net\/wp-content\/uploads\/2018\/07\/thumb-configuration-profiles.png\")
<\/a><\/p>\n802.11 Profile<\/h5>\n
![\"\"](\"https:\/\/www.airxperts.net\/wp-content\/uploads\/2018\/07\/thumb-view-802.11.png\")
<\/a><\/p>\nColumns<\/h5>\n
\n
![\"\"](\"https:\/\/www.airxperts.net\/wp-content\/uploads\/2018\/07\/thumb-column-prefs.png\")
<\/a><\/p>\nColouring Rules<\/h5>\n
\n
\n
![\"\"](\"https:\/\/www.airxperts.net\/wp-content\/uploads\/2018\/07\/thumb-colouring-rules.png\")
<\/a><\/p>\nFilter Buttons<\/h5>\n
\n
![\"\"](\"https:\/\/www.airxperts.net\/wp-content\/uploads\/2018\/07\/thumb-filter-button-defs.png\")
<\/a><\/p>\n![\"\"](\"https:\/\/www.airxperts.net\/wp-content\/uploads\/2018\/07\/thumb-filter-buttons.png\")
<\/a><\/p>\nIn Practice<\/h4>\n
Visual Patterns<\/h5>\n
\n
ONE-CLICK-SHOP<\/h5>\n
Using the Profile<\/h4>\n
Installing<\/h5>\n
Decryption<\/h5>\n
Wireless Toolbar<\/h5>\n
![\"\"](\"https:\/\/www.airxperts.net\/wp-content\/uploads\/2018\/07\/thumb-prefs-protocol-802.11.png\")
<\/a><\/p>\nRESET THE LAYOUT<\/h5>\n
Download<\/h5>\n