COMP416 Lab (7) IEEE Daoyuan

Transcription

1 COMP416 Lab (7) IEEE Daoyuan

2 Content Investigate wireless network protocol. Beacon Frames Data Transfer Association/Disassociation Learn to use appropriate Wireshark display filter to analyze the protocol. 2

3 General Frame format and Control field General Frame format 3

4 General Frame format and Control field General Frame format Frame Control field One byte in Wireshark (0xC0)

5 General Frame format and Control field General Frame format Frame Control field Table in next slide 5

6 Valid Type and SubType combinations 6

7 7 Beacon Frame

8 Wireshark_802_11.pcap This trace was collected using AirPcap and Wireshark We ll see frames captured on channel 6. Since the host and AP that we are interested in are not the only devices using channel 6, we ll see a lot of others frames that are not used for this lab, such as the beacon frames advertised by a neighbor s AP also operating on channel pcap 8

9 The Wireless Host Activities in Trace file Begins: Host associated with the 30 Munroe St AP At t=24.82: Host makes an HTTP request to IP address of gaia.cs.umass.edu: At t=32.82: Host makes an HTTP request to IP: At t=49.58: Host disconnects from 30 AP, and attempts to connect to the linksys_ses_24086 AP. At t=63.00: Host gives up trying to associate with the AP, and associates again with the 30 AP AP: 30 Munroe St AP AP: linksys_ses_24086 AP

10 Load Trace into Wireshark Y:\Win32\WiresharkPortable 10

11 Questions (1) - Beacon Frames Look at details of the IEEE frame and subfields in the middle Wireshark window. a. (2 marks) What are the SSIDs of the two access points that are issuing most of the beacon frames in this trace? b. (3 marks) What are the intervals of time between transmission of the beacon frames from 30 AP? How about AP? c. (2 marks) What (in hexadecimal notation) is the destination MAC address and BSS id in the beacon frame from 30 AP? d. (3 marks) The beacon frames from 30 AP advertise that it can support four data rates and eight additional extended supported rates. What are these rates? 11

12 Questions (2) - Data Transfer Find frame containing SYN TCP segment for this first TCP connection (that downloads alice.txt). a. (3 marks) What are the three MAC address fields in the frame? And what does the destination MAC address corresponds to? b. (2 marks) What is the IP address of the wireless host sending this TCP segment? What does the destination IP corresponds to? Find frame containing SYN/ACK segment for this TCP connection. c. (3 marks) What are the three MAC address fields in the frame? And what does the destination MAC address corresponds to? d. (2 marks) Does the sender MAC address in the frame correspond to the source IP address within this datagram? Explain your answer. 12

13 Questions (3) Association/Disassociation a. (3 marks) What are the two actions taken (i.e., frames are sent) by host just after t=49 to end the association with 30 AP? Explain Type and Subtype for layer action. b. (3 marks) Set the Wireshark display filter to display only AUTHENTICATION messages sent from host to AP (whose MAC is Cisco_Li_f5:ba:bb). Write down your filter setting, and answer how many those messages? Hint: the first AUTHENTICATION is started at around t=49. c. (2 marks) Does the host want authentication to require a key or be open? Explain it using a field in the management frame. d. (2 marks) Do you see a reply AUTHENTICATION from AP in the trace? If not, explain why not. 13

14 Questions (4) Association/Disassociation Consider what happens as host gives up associating with AP and now tries to associate with 30 AP. a. (3 marks) At what time is the first AUTHENTICATION frame from host to 30 AP, and when for reply AUTHENTICATION frame? An ASSOCIATE REQUEST from host to AP, and a corresponding ASSOCIATE RESPONSE frame from AP to host are used for host to associated with an AP. b. (5 marks) At what time is there an ASSOCIATE REQUEST from host to 30 AP? When is the corresponding ASSOCIATE REPLY sent? And write down your Wireshark display filter setting. c. (2 marks) What transmission rates are the host willing to use? 30 AP? 14

15 Resources Frame formats Section 7 in Quite useful!!! Computer Networking: A Top-down Approach, 5 th edition Section 6.3 Wireshark protocol hints. 15