SharkFest 18 Europe. Troubleshooting WLANs (Part 2) Troubleshooting WLANs using Management & Control Frames. Rolf Leutert

Transcription

1 SharkFest 18 Europe Troubleshooting WLANs (Part 2) Troubleshooting WLANs using Management & Control Frames Rolf Leutert Leutert NetServices Switzerland

2 Introduction 2 Rolf Leutert, El. Ing. HTL Leutert NetServices Zürich-Airport, Switzerland Network Analysis & Troubleshooting Protocol Trainings TCP/IP, WLAN, VoIP, IPv6 Wireshark Certified Network Analyst 2010 Wireshark Instructor since 2006 Sniffer certified Instructor since 1990 leutert@netsniffing.ch

3 Session Objectives 3 Learn why analyzing WiFi layer 2 is a demanding task Learn that WiFi frames looks very different from Ethernet Learn why WiFi frames have one to four address fields Learn how critical processes e.g. Joining, Roaming works Learn how to read Wireshark files to isolate WiFi problems Licensed by istockphoto.com Troubleshooting WiFi requires a full understanding of all Management & Control frames and its associated processes!

4 WLAN Management, Control and Data Frames Frame Types Overview Management Frames: Beacon Probe Request & Response Authentication & Deauthentication Association & Disassociation Reassociation Request & Response Action Control Frames: Request to Send (RTS) Clear to Send (CTS) Acknowledge / Block Acknowledge Request / Block Acknowledge Power Save Poll Data Null Function Data Frames: +

5 The IEEE Frame Formats 5 Four different frame formats are used FC Dur. RA FC Acknowledge, Clear to Send FC Dur. RA TA FC Request to Send FC Dur. RA TA DA/SA Seq. PDU Data Frame, Beacon, Probe Request, Probe Response, Authentication, Deauthentication, Association, Reassociation, Disassociation FC Dur. RA TA DA Seq. SA PDU Data Frame through repeater Field names: FC = Frame Control, Dur. = Duration, RA = Receiver MAC Address, TA = Transmitter MAC Address; DA = Destination MAC Address, SA = Source MAC Address, Seq. = Sequence, PDU = Protocol Data Unit, FC = Frame Check Sequence

6 WiFi Data Transmission 6 WiFi data frames have three MAC address field Sta2 AP FC Dur. RA TA DA MAC AP MAC Sta1 MAC Sta2 Seq. PDU Sta1 To Distribution System DA SA Type MAC Sta2 MAC Sta1 PDU Ethernet Frame DA SA Type MAC Sta1 MAC Sta2 Ethernet Frame Sta2 AP PDU From Distribution System RA TA SA FC Dur. MAC Sta1 MAC AP MAC Sta2 Seq. PDU Sta1

7 WiFi Data Transmission 7 Frames are marked with a direction bit (To or From Distribution System) Only Data frames are marked (not management and control frames) +

8 WiFi Data Transmission & Retransmission 8 WiFi data frames are acknowledged or retransmitted Sta2 AP FC Dur. MAC AP MAC Sta1 MAC Sta2 Seq. PDU Sta1 Data Frame FC Dur. MAC Sta1 FCS Acknowledgement

9 WiFi Data Transmission 9 In non-aggregation mode each packet is acknowledged individually The acknowledge frame follows immediately after each data frame The (single) acknowledge has no source address field

10 WiFi Data Transmission & Retransmission 10 WiFi data frames are acknowledged or retransmitted Sta2 AP FC Dur. MAC AP MAC Sta1 MAC Sta2 Seq. PDU Sta1 Data Frame FC Dur. MAC Sta1 FCS Acknowledgement All retransmitted frames are marked with the Retry Bit Sta2 AP FC Dur. MAC AP MAC Sta1 MAC Sta2 Seq. PDU Sta1 R Dur. MAC AP MAC Sta1 MAC Sta2 Seq. PDU R Dur. MAC AP MAC Sta1 MAC Sta2 Seq. PDU Data Frames FC Dur. MAC Sta1 FCS Acknowledgement

11 WiFi Data Transmission & Retransmission 11 All retransmitted frames are marked with the Retry Bit

12 WiFi Data Transmission & Retransmission 12 During retransmissions the transmit speed is reduced by the sender The reason for these retransmissions is the high noise level

13 Overview WiFi Standards 13 Rate Modulation Description 1 2 Barker/DBPSK Barker/DBPSK DSSS Long Preamble CCK/DQPSK CCK/DQPSK b High Rate (HR) with Short Preamble Rate Modulation Description 6, 9 12, 18 24, 36 48, 54 OFDM/BPSK OFDM/QPSK OFDM/16-QAM OFDM/64-QAM g Extended Rate PHY (ERP) 6, 9 12, 18 24, 36 48, 54 OFDM/BPSK OFDM/QPSK OFDM/16-QAM OFDM/64-QAM a From 6.5 up to 600* OFDM/16-QAM OFDM/64-QAM n High Throughput (HT) Extensions From 6.5 up to 600* OFDM/16-QAM OFDM/64-QAM n HT Extensions 2.4 GHz Band CCK = Complementary Code Keying DBPSK = Differential Binary Phase-Shift Keying DQPSK = Differential Quadrature Phase-Shift Keying OFDM = Orthogonal Frequency Division Multiplexing BPSK = Binary Phase-Shift Keying QPSK = Quadrature Phase-Shift Keying QAM = Quadrature Amplitude Modulation From 86 up to 6930** OFDM/16-QAM OFDM/64-QAM OFDM/256-QAM 5 GHz Band * With up to 2 Channels and up to 4 Streams **With up to 8 Channels and up to 8 Streams ac Very High Throughput (VHT)

14 Management Frame: Beacon 14 Beacon tags contain information about supported and required features Standard a rates HT (High Throughput) n supported Robust Security Network contains info about type of authentication & encryption VHT (Very High Throughput) Standard ac supported

15 Management Frames: Probe Request & Response 15 A client sends Probe Requests to scan the channels for Access Points Capturing with multiple AirPcaps shows the scanning process

16 Management Frames: Probe Request & Response 16 Probe Request contains client features and specific or broadcast SSID Access Points reply with Probe Response, containing same fields as Beacon Client supports a/n/ac

17 Management Frames: Authentication & Association 17 The client selects an Access Point and sends Authenticate & Associate requests Both processes must be successful in order to join the Access Point

18 Decrypting WEP, WPA & WPA2 PSK 18 Wireshark can decrypt WEP, WPA & WPA2 PSK if the key is available To decrypt WPA & WPA2 the key negotiation process must be captured

19 Client joining problem 19 A client needs up to a minute duration to join an Access Point Analyzing the trace file discloses the reason: Access Point, Media or Client?

20 Analyzing the WiFi roaming process 20 A client is roaming from channel 1 to 11 because the SNR of the new AP is better Capturing the roaming process requires multi-channel equipment

21 Client roaming problem 21 User is complaining about sporadic hangers in bar code scanners, up to minutes Vendors of mobile clients and access points are finger pointing, since month. Problem could be assigned to bar code vendor by analyzing trace files.

22 Client roaming problem 22 Using IO Graph to show signal strength of different sources AP a9:3b:c0 CH A40 Client fb:c4:57 AP a9:3c:60 CH A36 Graph 2 Color Filter: wlan.sa == 00:1b:2b:a9:3b:c0 Graph 4 Color Filter: wlan.sa == 00:1b:2b:a9:3c:60 Graph 5 Color Filter: wlan.sa == 00:15:70:fb:c4:57

23 Control Frames: Request to Send / Clear to Send 23 A WLAN node can reserve airtime and refrain all other stations from sending RTS/CTS reservation is used in busy cells, Hidden Node situations or in mixed mode A short form, so-called CTS-to-Self is often used in cells with B-Only clients present

24 Overview WiFi n/ac Raw Rates 24 +

25 WLAN Layer 2 capturing with AirPcap 25 Key features: WiFi radios can use multiple 20 MHz channels (n/ac) to increase throughput Each radio cell is a shared media and is controlled by an Access Point (AP) A mobile client can be associated with only one AP at the time Radio cell access is controlled by managements and control frames Wireshark with AirPcap can capture and analyze these frames Understanding of these frames is crucial for WLAN troubleshooting AirPcap Nx a/b/g/n USB - adapter works with Wireshark and captures WiFi packets in both 2.4 GHz and 5 GHz bands. +

26 WLAN Layer 2 capturing with WaveXpert 26 Softing IT Networks introduces the new WaveXpert Includes 4 wireless adapter with 16 integrated antennas Supports 4x4 MIMO up to IEEE ac Wave 2 USB-C type plug for data and power 2.4 GHz or 5 GHz versions available 4 x 4 : 4 up to 4 Channels bonded (1 730 Mbps) 2 x 2 : 2 up to 8 Channels bonded (1 730 Mbps) Creates pcapng files incl. Radiotap header Retail price: EUR Availability: planned for 1 st Qu Multi-Channel WLAN Sniffer Requirements: LINUX notebook and USB-C (Thunderbolt 3) Supporting most Linux s and Mac OS Joint development of: Softing IT Networks GmbH Haar, Germany and GHMT AG Bexbach, Germany +

27 WLAN Layer 2 capturing with WaveXpert 27 Softing IT Networks introduces the new WaveXpert Includes 4 wireless adapter with 16 integrated antennas Supports 4x4 MIMO up to IEEE ac Wave 2 USB-C type plug for data and power 2.4 GHz or 5 GHz versions available 4 x 4 : 4 up to 4 Channels bonded (1 730 Mbps) 2 x 2 : 2 up to 8 Channels bonded (1 730 Mbps) Creates pcapng files incl. Radiotap header Retail price: EUR Availability: planned for 1 st Qu Multi-Channel WLAN Sniffer Requirements: LINUX notebook and USB-C (Thunderbolt 3) Supporting most Linux s and Mac OS Joint development of: Softing IT Networks GmbH Haar, Germany and GHMT AG Bexbach, Germany +

28 Supported maximum capture rates 28 * * AirPcap Nx supports Legacy, HT20 or HT40 mode (no SGI & Greenfield mode) ** ** ** Softing WaveXpert supports up to 8 channels per WLAN adapter +

29 WLAN Layer 2 capturing with WaveXpert 29 WaveXpert configuration menu allows to select up to four adapters for capturing Each adapter supports Bandwidth up to 80MHz (four 20MHz channels bonded) Long Term stores packets directly to files, without starting Wireshark Creates an individual pcapng file per WLAN adapter Creates a new file per adapter every 5 minutes Packet size (Snaplen) is set to 500 Bytes +

30 WLAN Layer 2 capturing with WaveXpert 30 The WaveXpert adapters and configurations will be imported to Wireshark for capturing

31 WLAN Layer 2 capturing with WaveXpert 31 Simultaneous capturing in channels 36, 40, 44 & 48

32 802.11n/ac Frame Aggregation A-MSDU 32 Aggregate-MAC Service Data Unit (A-MSDU) wraps multiple Ethernet frames into one frame up to 8KB size If frame has FCS error, the whole frame has to be retransmitted Not suitable for noisy environment Multiple Ethernet Frames Preamble EN Header Data Preamble EN Header Data Preamble EN Header Data Radio n A-MSDU 1 A-MSDU 2 A-MSDU last Preamble Header MAC Header EN Header Data EN Header Data EN Header Data FCS Aggregated MAC Service Data Units

33 802.11n/ac Frame Aggregation A-MSDU 33

34 802.11n/ac Frame Aggregation A-MPDU 34 Aggregate-MAC Protocol Data Unit (A-MPDU) allows bursting up to frames Reduced Interframe Space keeps receiver synchronized New Block ACK allows to confirm up to 64 frames individually Only bad frames need to be retransmitted Radio n Preamble Header MAC Header Data A-MPDU FC S A-MPDU 2 1 Aggregated MAC Protocol Data Units A-MPDU last 0 More Bit RIFS More Bit RIFS More Bit (Reduced Interframe Space: 2µs)

35 802.11n/ac Frame Aggregation A-MPDU 35

36 802.11n/ac Frame Aggregation A-MPDU Block-Ack 36 A-MPDUs Block ACK Sequence # Bitmap (64 bits) Start Sequence # = 65 lost frame A-MPDUs Sequence # Start Sequence # 65 + Block ACK Bitmap (64 bits) = 129 A-MPDUs retransmitted frame Block ACK Sequence # Bitmap (64 bits) Start Sequence # = 192

37 802.11n/ac Frame Aggregation A-MPDU Block-Ack 37

38 SharkFest 18 Europe Hope you learned something useful! SeaPics.com Rolf Leutert, Leutert NetServices, WLAN Trainings with Wireshark & WaveXpert available in Germany and Switzerland