I have APs that can capture Radiotap packets before/after encryption/decryption, so they're in plaintext. Is it possible to have wireshark de-encapsulate the data packets so I can see what protocols are being used? I've uploaded an example capture to Cloudshark, it's an iPad associating and visiting http://bbcnews.com/. At packet 198 you can see a DNS request, 199 is the response, then 206 is an HTTP request. asked 23 Feb '14, 19:46  TRS-80 edited 27 Feb '14, 00:16  Guy Harris ♦♦ |
One Answer:
The issue isn't encapsulation. The issue is that the frames have the "this is protected data", i.e. "this is encrypted data", flag set, but the data appears not to be encrypted. Therefore, what you want to do is to set the "Ignore the Protection bit" preference for the "IEEE 802.11" protocol to "Yes - without IV"; Wireshark should then assume that those frames are decrypted, and dissect them. answered 27 Feb '14, 00:15 Guy Harris ♦♦ Thanks, that shows some a bit more detail, but I'm only seeing dissecting as far as LLC, the data isn't being further dissected down to TCP/UDP and higher layer protocols. (27 Feb '14, 16:56) TRS-80 1 Try setting "Ignore the Protection bit" to "Yes - with IV"; that worked for me. (27 Feb '14, 17:01) Guy Harris ♦♦ Ah-hah, that does the job. Thanks. (27 Feb '14, 17:31) TRS-80 |
what is the capture format of your AP?
As long as the AP writes a pcap file in a format that Wireshark understands, it should be able to dissect the content of the file, with or without radiotap header.
Is it possible to post a small sample capture file somewhere (google drive, dropbox, cloudshark.org)?