Frames and more Frames

Frames

One of the main topics that we should learn is the concept of 802.11 frames to take successfully the CWAP exam. In this chapter, we will introduce the evolution of general frame since creation until current 802.11ac frame and explain briefly each field related to general frame.

802.11 General Frame Format from 802.11-1997 and 1999

In 802.11-2007 were incorporated some changes. The Frame Body field is now from 0-2304 and because of 802.11e QoS, was aggregated QoS Control field to pass information QoS and define queue operations in the STAs.

802.11 General Frame Format from 802.11-2007

With 802.11n ratification, in 2009 was incorporated 802.11-2012. This permits a longer Frame Body with A-MSDU, also we can see that was introduced the HT Control field that contains information related to Transmit Beamforming and Antenna Selection (ASEL) and another more.

802.11 General Frame Format from 802.11-2012

The 802.11ac format shows the Frame Body field as variable for length with a minimum of 0 octets and maximum length based in MMPDU, MSDU, A-MSDU and MPDU that are received for the PPDU format. Finally, fields like QoS Control, Address 4, HT Control, TKIP, CCMP GCMP and MIC can impact the length of Frame Body. 

802.11 General Frame Format from 802.11ac-2013

Now we will do a brief description of each field related to a general frame 802.11:

Frame Control

Frame Control Field 802.11-2012

1. The Protocol Version bits are always set a 00.  
2. The Type and Subtype fields (6-bits) define the frame type (management, control o data) and the subtype. Next table lists the important valid values for these bits.
   
   

 

3. The subfields To DS and From DS bits determine whether a frame is transmitted from a STA to the AP, from one STA to another in a IBSSS or using the four-address MAC header format (mesh BSS). Next table shows the To DS and From DS values appropriate as defined in the 802.11 standard.
   
   

4. The More Fragments subfield (1-bit) determines whether current frame is part of fragmented frame or not.
5. The Retry Field (1-bit) is used when a frame is retransmitted that include the Retry field set to 1.
   
   
6. The Power Management field (1-bit) is a bit indicating whether power management is used by the STA.
   
   
7. The Protected Frame field (1-bit) indicates whether the  MSDU is encrypted in the frame if it is set to 1.
   
   
8. The Order field is set to1 in a non-QoS data frame to indicate that it contains an MSDU. It is set to 1 in a QoS data or management frame to indicate that the frame contains an HT control field.

Duration ID

The Duration/ID field is used for two purposes. First, it may contain the duration of the frame. Second, it may contain the association identifier (AID) of the STA that transmitted the frame.

Address 1, 2, 3 and 4

The 802.11 general frame format specifies four address fields. The next table provides an overview of the use of these fields.

Sequence Control

It is used with fragmentation and for the removal of duplicate frames should they occur. It is divided into a 4-bit fragment number and a 12-bit sequence number (16-bit total). When an MSDU is fragmented, all fragments have the same sequence number and the fragment number is incremented by 1 for each frame until all fragments are delivered. The sequence number start at 0 until it reaches 4095, then simply resets to 0 and begins again.

QoS Control

It is a 16-bit field that identifies the category to which the frame belongs for queuing purposes. The most important factor in this field is the user priority (UP). EDCA is implemented in QoS WLANs based on WMM certification the bits 0-3 in the QoS Control field are mapped with possible values from 0 to 7. The next table lists the mapping of WMM access categories (ACs) to 802.1d tags.

HT Control

It is used to specify parameters related to the HT operations and VHT operations.

HT Control Field in 802.11-2012

HT Control Field in 802.11ac

**** Source: CWAP Official Study Guide by Tom Carpenter

How to Use Wireshark to Capture, Filter and Inspect Packets

Wireshark, a network analysis tool formerly known as Ethereal, captures packets in real time and display them in human-readable format. Wireshark includes filters, color coding, and other features that let you dig deep into network traffic and inspect individual packets.

This tutorial will get you up to speed with the basics of capturing packets, filtering them, and inspecting them. You can use Wireshark to inspect a suspicious program’s network traffic, analyze the traffic flow on your network, or troubleshoot network problems.

Getting Wireshark

You can download Wireshark for Windows or macOS from its official website. If you’re using Linux or another UNIX-like system, you’ll probably find Wireshark in its package repositories. For example, if you’re using Ubuntu, you’ll find Wireshark in the Ubuntu Software Center.

Just a quick warning: Many organizations don’t allow Wireshark and similar tools on their networks. Don’t use this tool at work unless you have permission.

Capturing Packets

After downloading and installing Wireshark, you can launch it and double-click the name of a network interface under Capture to start capturing packets on that interface. For example, if you want to capture traffic on your wireless network, click your wireless interface. You can configure advanced features by clicking Capture > Options, but this isn’t necessary for now.

As soon as you click the interface’s name, you’ll see the packets start to appear in real time. Wireshark captures each packet sent to or from your system.

If you have promiscuous mode enabled—it’s enabled by default—you’ll also see all the other packets on the network instead of only packets addressed to your network adapter. To check if promiscuous mode is enabled, click Capture > Options and verify the “Enable promiscuous mode on all interfaces” checkbox is activated at the bottom of this window.

Click the red “Stop” button near the top left corner of the window when you want to stop capturing traffic.

Color Coding

You’ll probably see packets highlighted in a variety of different colors. Wireshark uses colors to help you identify the types of traffic at a glance. By default, light purple is TCP traffic, light blue is UDP traffic, and black identifies packets with errors—for example, they could have been delivered out of order.

To view exactly what the color codes mean, click View > Coloring Rules. You can also customize and modify the coloring rules from here, if you like.

Sample Captures

If there’s nothing interesting on your own network to inspect, Wireshark’s wiki has you covered. The wiki contains a page of sample capture files that you can load and inspect. Click File > Open in Wireshark and browse for your downloaded file to open one.

You can also save your own captures in Wireshark and open them later. Click File > Save to save your captured packets.

Filtering Packets

If you’re trying to inspect something specific, such as the traffic a program sends when phoning home, it helps to close down all other applications using the network so you can narrow down the traffic. Still, you’ll likely have a large amount of packets to sift through. That’s where Wireshark’s filters come in.

The most basic way to apply a filter is by typing it into the filter box at the top of the window and clicking Apply (or pressing Enter). For example, type “dns” and you’ll see only DNS packets. When you start typing, Wireshark will help you autocomplete your filter.

You can also click Analyze > Display Filters to choose a filter from among the default filters included in Wireshark. From here, you can add your own custom filters and save them to easily access them in the future.

For more information on Wireshark’s display filtering language, read the Building display filter expressions page in the official Wireshark documentation.

Another interesting thing you can do is right-click a packet and select Follow > TCP Stream.

You’ll see the full TCP conversation between the client and the server. You can also click other protocols in the Follow menu to see the full conversations for other protocols, if applicable.

Close the window and you’ll find a filter has been applied automatically. Wireshark is showing you the packets that make up the conversation.

Inspecting Packets

Click a packet to select it and you can dig down to view its details.

You can also create filters from here — just right-click one of the details and use the Apply as Filter submenu to create a filter based on it.

Wireshark is an extremely powerful tool, and this tutorial is just scratching the surface of what you can do with it. Professionals use it to debug network protocol implementations, examine security problems and inspect network protocol internals.

You can find more detailed information in the official Wireshark User’s Guide and the other documentation pages on Wireshark’s website.

**** References: Chris Hoffmann page and Wireshark Guides