This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How to find the connection type of a network from Wireshark trace?

0

I'm doing some analysis on a wireshark network trace. How to find the connection type of the underlying network? (eg: wireless)

Is it possible to obtain this information from packet analysis?

Thanks in advance.

Lasith.

asked 07 Sep '13, 07:21

Lasith%20Eranda%20Haputhanthiri's gravatar image

Lasith Erand...
1111
accept rate: 0%


One Answer:

0

You could take a look at the lowest layer you find in the trace - if there's a 802.11 radio layer it's most certainly wireless. If there's an Ethernet layer, it's (in most cases) Ethernet. If there's TokenRing, it's TokenRing.

But you can also take a look at the Summary option in the Statistics menu, and look at the "Encapsulation" that is mentioned.

answered 07 Sep '13, 07:41

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

From your comments I was able to find that packets are sent through Ethernet. But my network connection is a wireless one. How can I distinguish whether the network is wired or wireless?

(07 Sep '13, 07:52) Lasith Erand...

If you captured the frames on Windows and did not use the AirPCAP adapter you will only be able to capture from Ethernet layer up, and it will look like it was just an wired Ethernet trace. I'm not sure if there is any way to tell from that kind of trace that it was actually a wireless connection - maybe if you saved the file in PCAPng format you can tell from the interface name that is also mentioned in the Statistics, but that once again won't help on Windows (because it is using GUIDs that won't tell you much unless you have access to the PC the trace was captured on)

(07 Sep '13, 08:10) Jasper ♦♦

If you captured the frames on Windows and did not use the AirPCAP adapter you will only be able to capture from Ethernet layer up, and it will look like it was just an wired Ethernet trace.

The same also applies on most UN*Xes if you're not capturing in monitor mode.

(07 Sep '13, 13:35) Guy Harris ♦♦

So you'd either have to look for protocols used by Wi-Fi devices (e.g., by access points) or look for something such as packet loss patterns that are more likely on Wi-Fi than Ethernet. (I don't have any suggestions to make for either of those cases.)

(07 Sep '13, 13:40) Guy Harris ♦♦

From your comments I was able to find that packets are sent through Ethernet. But my network connection is a wireless one. How can I distinguish whether the network is wired or wireless?

How did you capture the wifi traffic?

  • Tools (Wireshark, etc.)
  • OS (brand, version)
(09 Sep '13, 06:04) Kurt Knochner ♦