Wireless Packet Monitoring and Analyzing System

Wireless Packet Monitoring and Analyzing System









































































































































[email protected]

[email protected]

[email protected]

















                 ! " # $% &  ' ( ) * + ,- . / 0 1 23
   4 5 6 7  8 9 : ;—Wireless Packet Monitoring and Analyzing System (WPMAS), WPMAS<= > ?@8 9 @AB C IEEE 802.11D E 4 5,WPMASFGH I J K  L M N 

O P @Q R S T
' ( )UV W X Y

Z@[L \I J ] ^ IEEE 802.11DE _ ` ,WPMAS a  b c 5d (1) FB C IEEE 802.11DE 4 5e(2) Ffg IEEE 802.11DE  4 5B C ; h ijke(3) GH I J l / m / n X o p ,



qIEEE 802.11 Protocol@4 56 7 8 9 : ;,

Abstract

To promote the development of wireless network, some tools and software are needed. In this paper, a wireless packet monitoring and analyzing system (WPMAS) is introduced. WPMAS can capture, analyze, and generate IEEE 802.11 protocol packets. WPMAS can also help user to understand the concept of IEEE 802.11 protocol concept, detect the problem of network, and check that the wireless software or hardware works well. The major contributions of WPMAS include (1) generating IEEE 802.11 protocol packets, (2) generating statistic data and chart of IEEE 802.11 protocol packets, (3) providing English/Chinese Interface.

Keywords: IEEE 802.11 Protocol, packet monitoring and analyzing system.

1.

















r s t u v w x y z (mobility){ | } ~  €   N ‚ ƒ„ ;… † ‡ T ˆ
‰ Š ‹ v w " Œ [2], Ž
  ‘ ’ “ ” … † ‡ T ‚ ƒ•– 2— ˜ ™ v w š„ ;…  › C œ  ž ,Ÿ  ¡¢ a £ ¤¥ ¦  § ¨ © ª ¡« ¬ y ­ ® ¯ « °± ² ³ ´ ‚ ƒ µ a £
‰ ²® ¯ l ¶ · † ¸ ?® ¯ ¹ º h E,µ ¡¢  »
a £ ¼F ²¡¢ ½ ¾ ¿ À » Á ±
· † [¸ ?% X °Ã " h E,€ Ä
  GH v w x y z Å v w Æ Ç È ‚ ² É Ê ,
                 ! " # $% &  ' ( ) * + ,Ÿ  23 FË Ì
4 56 7 8 9 ' )F[\I J K  L M N
O P ,I J FÁ ± Ä' )Ã > ? 4 5h Eu ] ^ Í Î
 W X Ï Ð ,Ä' )•FÅ Ñ 
' ( ) Ò Ó Ô Õ Ö v × f g ØÕ ' ( )– x Ù 7 Ú 7 ,Û Ä' ) F\Y šÜ Ý
 Ü C ] ^
 _ ` ,Ü C FÞ ± ] ^ à > ? 4 5ß T L  ž u à áâ 㠆 Ã Ü ä å æ @– ŽY Q ç è
 W X ‡ T , - . / šÄGé 23
4 56 7 

8 9 : ; —Wireless Packet Monitoring and Analyzing System (WPMAS),WPMASGH I J > ?@8 9 L B C
4 5ê <, Äë WPMASìí î jï ð o p Å I J < ñ ò > ?@8 9 @[L B C
4 5Aó \ I J ô ^
4 5 ß T @N ^
4 5W X õ ö @– Ž÷
O P ,WPMAS• GH I J l m / o p Å I J ø ù ú û ü ýñ ò þ Ü Ý
 _ ` , - . /
IEEE 802.11DE @[ L 2 ¹ º 4 56 7 8 9 ' ),  u w ¤ o WPMAS: ;   N ` @: ; [L ¹ º   ¯ P ,š  w ¤o WPMASS 3  : ;   ‡ T ,    w š    WPMAS  x  Ð , U- . /  . [L  u  ,

2.

































  ¤IEEE 802.11DE [L ¹ º 4 56 7 8 9 ' ),

2.1 IEEE 802.11

























. / à 1 802.11  IEEE 802.11DE  L   C [email protected]@802.11gêS   ,[Í Î Z 802.11b!Ÿ Ø " „ #  $ !% & 11 Mbps… ' ( ) !300m *(+90¡

*),k1!S , Æ - 802.11 ./ [3],    1 802.11     IEEE  ´ 0 1 802.11 1Mbps ~ 2Mbps 2.4 GHz 802.11a  " F2 54Mbps 5 GHz 802.11b 5.5Mbps~11Mbps 2.4 GHz 802.11g  " F2 54Mbps 2.4 GHz 802.11 MAC E3±  4 (Header)@E3a ) (Frame Body)5 6 Ù 7 8 (FCS)Ã Ø   j1 [3], 1 802.11 MAC  
 4 (Header)q 4 5d MAC À 9 @: ƒ8 ê802.11E3h E,

E3a )(Frame Body)qE3a ); < !h i = À (Data Field)> ? š% X @ A „ B † C h i(Payload),

5 6 Ù 7 8 (Frame Check Sequence)q5 6 Ù 7 8 D Z I D E F G Ù 7 8 (Cyclic Redundancy Check),

802.11   H , MAC E38 I !h iE

3@: ƒE3L £ N E3,

h iE3(Data Frame)qh iE3> ? š% X @ ë A „ J h i,Æ d ¾ ¿ h i KE3•L

²h iE3,

: ƒE3(Control Frame)q: ƒE3DZh iE3M * I ,µ E3a > ? N O P K@0 Q ?ä [L R S Ú 7 T U A²V W h i°X [ Á ÄY – % X @ A h i„

# FZ z ,

£ N E3(Management Frame)q£ N E3> ?

6 [
N O  W X ,µ E3a u ~ \ Ô ] é
[L M N  þ ^ ë A ·  _ ¬ ` a , €
h ib c d 802.11 MAC 4 ì e f g h  <5i I  3 À 9 = À ,Aj à … E3® I à … À 9 = À k À 9 = À l ® ± ² MAC E3, m Æ - Ž… à c d ,802.11 MACE3 4 = À ß T  j2à n [1,2]q 2 802.11 MAC     

Frame ControlqFrame Control= À 5d [ S , o = À  j3Ã n , 3 Frame Control   
Duration/IDqÄ= À … H , ï T 5d (1)$ 15 3 À p  ! 0 °Ä= À u   NAV (Nework Allocation Vector)e(2)$ 143 À p !0Ž 153 À p !1kn šq r s ØA à „ J E3t 8 e(3)$ 14 153 À p -° !1kn !u § v T -w x yPS-PollzE 3t 8 ,
Addressq23 802.11 E3 f 5d  3 À 9 = À ,{  À 9 = À | } E3m  Æ - Ø X ® … à c d ,

Sequence ControlqÄ= À ²~  E3€ 1 [ L  ‚ ~ ƒ E3,„ U± 43 À p Fragment Number o = À L 12 3 À p Sequence Numbero = À à  ,

š… † z ‡ p 802.11 ì  WEP(Wired Equivalent Privacy)~ ‡  ˆ [2],WEP a GH R á(Authentication)L h i‰ ‡ (Privacy)Š,  <,

802.11GH Š, R á ‹ Œ q Ž : ;T (Open System)L   ‡ ‘ T (Shared Key)Î J U802.11 ½  R ᇠ‰ ,% X @ Gé R ጠ°F  ¾ 2, ‡ ‰ – x ’ “ R á,

4 WEP  

j4!Þ ” WEP~ ‡ E3ß T [2],E3• ”   z Ù à – — ‰ B C 23 < !  z Ù à ˜ (Integrity Check ValueICV) ™ š ˜ (hash),ICV FQ ‰ E3š„ J ” ö l  › œ ˜ ,

2.2 IEEE 802.11
  



















Í Î 4 56 7 L 8 9 ' )a 8 Š, m I 2 , U¤' )  š2 a ž † Û 2, U¤' )  ²± Ÿ † ,  2, m I W X ‡ T !q
  Â  Promiscuous ModeÄ°® > ?†

à … 4 5(Æ . Mac Address UV !µ ¡  MAC Address),ŽÛ 2, m I W X ‡ T U Ø ± Ÿ g z ,€ !Æ -  4 5„ J °¢ " Þ ± ı Ÿ _ J ı Ÿ Æ " ¤Â   Promiscuous Mode£ F6 7 {  _ J 4 5,    2           
     Open Source    Wireless Snifffer Wireless [4] Windows     NetworkView [5] Windows     LanExplorer [6] Windows     TCPdump [7] Linux     Ethereal [8] Windows/Linux      Sniffit [9] Window/Linux    Airopeak [10] Window     Kismet [11] Linux   

 k2à n šWindowsE¤  & … ¥ ¦ I J o p 4 56 7 L 8 9 ' )§ f !Ó V ¨ ' ),Ø' )© © Æ ¡ ت« 8 •¬ ­ ® ¯ > ?@8 9 802.11
4 5  <,šLinuxE ¤  Z TCPdump ° … è é ª« 8 AGH > ? 802.11
4 5  <U± … jï o p   Å I J ² W j ZÆ £ ,Û  TCPdump } ~ ²³ ´ I J   µ ¶> ?à " 4 5s ·
‰ 8 9 @; à > ? 4 5,EtherealF> ?802.11
4 5AF¶ jï o p u   > ?” ¸  <,UEthereal!fg … à   ' )¹  fg 802.11
 g z   # $ 4 56 7 8 9  <,

3. WPMAS









WPMASU[Ethereal!  à  4 56 7 8 9 : ;,Ä: ;   Š ‹ I J [ º 3 " Œ q
WPMAS <= > ?A8 9 802.11
4 5,
WPMASo p   ! » ¼ ½ ¾g I J í î ¿ ªÀ ,
WPMAS<= Á ¼GH 802.11
4 5 ¹ º ; h ijk,
WPMASGH I J Š, ú û o p ¼l / o p m / o p ,
WPMASGH I J B C 802.11
4 5  <,
WPMAS! Ž z ª8 ' ),


 

              !!!!5 WPMAS"""" #### $$$$ !!!!  j5à n WPMAS5d º 3  : ;¼I J a  p  : ;(User Main Interface Subsystem, UMIS)@4 5> ? : ;(Packet Capture Subsystem, PCS)@Ã Ä £ N  : ;(File Management Subsystem, FMS)@4 56 7  : ;(Packet Monitor Subsystem, PMS)@4 5B C  : ;(Packet Generator Subsystem, PGS)@[L I J Å \ : ;(User Help Subsystem, UHS),% 3  : ;  <0 1   q
I J a  p  : ;> ? Æ Ç ØÈ  : ;A É n ˆ > ? 4 5Ê Ë 4 5ß T Ì k,
4 5> ? : ;> ? > ?@Í Î 4 5  <,
Ã Ä £ N  : ;> ? Ï Ð @¸ ?@[L Ì Ñ 4 5> ? : ;à > ? 4 5,
4 56 7  : ;GH I J 4 5> ? : ; Ã > ? 4 5; h ijk,
4 5B C  : ;GH I J B C 4 5  <,
I J Å \ : ;GH I J WPMASn X Ò Ó Ô Õ [L l m / o p _ Ö  <, ± ²
Â × €   Ø y ö T ‚ ƒÙ 8 Â
‰ ^ 9 802.11
4 5 4 ß T ,€ ÄWPMASÚ ® ¯ g  Â× € Ø y ö T ,Í Î Ã å GH ® ¯ Â× € … Prism 2 : Ì    Dark Marketing Corp. Ã Û Ü XI-325PCMCIA Â[12]ØÂà I  Ø y ö T ! The Linux pcmcia-cs Package à G H [13],

4. WPMAS

!

!

!

!

"

"

"

"

#

#

#

#

$

$

$

$

WPMAS5d ô º 3  : ;Øl PCS@FMS@ UMIS êH 3  : ;U Ethereal ª…  <Ž PMS@PGS@[L UHSUÝ ˜ Ethereal Ù 8  < Ô Þ }  : ;,   ô Ethereal ˆ Þ   : ;w ¤ß à þ 0 1 WPMASS 3  : ;   W X õ ö ¼PMS@PGS@[L UHS

 : ;,

WPMAS, WPMAS °" H 3 á T â  \¼Libnet@GDChart Library@[L GTK+, w Ý ˜ AÞ } Libnet Ù 8 á T [\ PGS, GDChart LibraryUu \ PMS,Û GTK+

Uu \ jï ð I J o p ,

4.1 PMS

PMS5d  3 p ã 8 I !4 5; jk@  8 ä j@” ¸ Ÿ Î å    ,{  p ã l   8 ä j@” ¸ Ÿ @Î å    UEtherealª …  <4 5; jkUw ~ [Ý ˜ p ã ,  w a  I H 3 á T u  4 5 ;  j k¼w Þ } á T â qSatistic_Graph()[L GDChart Ã æ … á T â qGDC_out_pie()ç GDC_out_graph(), { › 23 Ÿ  u Ò Ó PMS  ¿ B C ; j k,$I J è Î ¾Frame Type Statistic Graph¿ PMSé ê Statistic_Graph(),Statistic_Graph()¤é ê GDC_out_pie()B C à " ë ì j,$PMS à " ; jkÇ ¶ GTK+à í î ï ð o p É n ²ñ ò † ,

4.2 PGS

w a I Packet_Libá T â u  PGS, Packet_Libá T â I Libnetá T â [L Ù 8 Þ } Ô Ý ˜ ” Libnetá T â u B C 4 5,I J    S C 4 5 = À Aó  ¾Send Packet¿ó ô  Packet_Lib á T â ¤B C I J à " 4 5AÞ ±

I J à Πå „ J é õ ,

{ › 23 Ÿ  u Ò Ó PGS ¿ B C 4 5,$ I J ö  S C 4 5= À Aó  ¾Send Packet¿ ó ô PGS© I J jï ð o p > ?I J # \ ˜ A¤Ø# \ ˜ Ï Ð ­ WPMAS à  ÷ ™ ¶Ÿ   wifi_packet@ipv6_packet@udp_packet [L ØÈ ¹ º ™ ¶,PGS | ¤{  ™ ¶„ B ­ Packet_Lib l packet_create() á T ,   packet_create()³ ´ à „ \ ™ ¶B C
 IPv6 UDP4 5,

4.3 UHS

UHS 5d Š3 p ã ¼l m / o p _ Ö [L WPMASI Ô Õ ,l m / o p _ Ö  <Å I  J FÎ å Øø ù ú û o p ,Û I J F7 ú WPMASGH I Ô Õ u n X WPMAS, { › 23 Ÿ  Ò Ó UHS  ¿ © m / o p Î _ Ö ­ l / o p ,$I J Î å l / o p Î  WPMAS¤š/tmp/PMASv6.lang.conf  ØE ¤ ™ ¶,WPMAS~ Þ û y WPMASÙ 7 ØE

¤ ™ ¶ ¶ menu.cl switch_language()¤ m / o p _ Ö ­ l / o p ,

5. WPMAS

%

%

%

%

&

&

&

&

'

'

'

'

(

(

(

(

WPMASF²
E¤ l    x > ?
4 5@B C 4 5@B C 4 5; jk@[L l m / o p _ Ö ê <,  8 H 3 ü  8 I o A  {   <  x  Ð ¼B C 4 5@4 5;  jk@[L l m / o p _ Ö ,> ?
4 5  <!Etherealª…  <  Æ ~ [0 1 ,

  7 ý E¤ ! CPU U Intel Centrino 1.4GHz@¦ þ )§ ü !1GBLinux
URedhat 9.0Kernal
U 2.5.13-8
Â! Dark Marketing Corp.Ã Û Ü XI-325 PCMCIA
 Â,

5.1    

























WPMASGH I J B C 4 5  <, j6 Ã n I J F  IEEE 802.11
4 5 4 S 3 = À Ÿ  E3: ƒ= À (Frame Control)l Subtype@ToDS@[L FromDS êê= À , Äë

I J •F  ØÈ m  4 5 4 Ÿ  h

i·  C Ethernet 4 @C IPv4 IPv6  4 @[L „ # C TCPUDP 4 ,

6   %%%% &&&& '''' (((( 802.11 )))) **** ++++ ,,,,

I J F[  4 5„ J ¹ º µ ¶, j 7

à n I J F[  Ë o 4 5„ J ¶ (Packet Amount Per Time)@4 5„ J A ß (Packet Burst Interval)@ [ L 4 5 „ J o ¶ (Packet Burst Amount),I J •F  „ J 4 5,

7   %%%% &&&& '''' (((( ---- .... //// 0000 )))) **** ++++ ,,,,

PGSB C 4 5 ´ +!% & 303 4 5,. ’  A Û Ü ( ) 4 5 B C Ÿ 4 5 B C  ´ [14]' )à B C 4 5´ / !  ,€ ÄG  4 5B C ´ ¼!Ä: ; u ˜ – % X ë 2,

5.2      





































WPMASGH I J ¹ º
4 5; h

ijk5d
E3; jk@h iE3

(Data Frame); jk@: ƒE3(Control Frame);  jk@[L £ N E3(Management Frame) ; j k, 8 1111 2222 3333 4444  #### 5555  
E3; jk; Ã > ? 4 5l

h iE3@: ƒE3@[L £ N E3êH m E3Ã

d 4 5¶ [L § ü .Ÿ , j8à n Ä; jk± Š3 ë ì j[L Š3 kß Ã  ,† ‡ ë ì jkß É n H ,
E3 4 5¶ Ø .Ÿ , ‡ ë ì jkß É n H ,
E3 4 5§ ü  Ø.Ÿ , 9 1111 2222 3333 4444 6666 7777  #### 5555     h iE3; jk@: ƒE3; jk@[L £ N E3; jk¢ !; ØSubtype 4 5¶ [L § ü .Ÿ ,[j9h iE3; jk!Ÿ Ä ; jk± Š3 ³ j[L 23 kß Ã  ,  Š3 ³ j8 I É n h iE3l S 3 Subtype 4 5¶ [L § ü  ,  kß À É n S 3 Subtype 4 5§ ü  ß à ¶´ .Ÿ , WPMASB C 2, ; jk ' <!2 3 4 5 8 9 °A ~ †  Û jk °A  +" H & ,f g ; h i ' <Ä: ;  u Í  U  20% h iM N °A ,

5.3      





































 j10j11à n WPMASGH I J Š , ú û o p ¼l / o p m / o p ,I J FÁ ± Ä <Î å Øø ù ú û o p , 10 WPMAS8888 9999 ++++ ,,,, 11 WPMAS:::: 9999 ++++ ,,,, I  J  Ö o p ú û   ! » ~ Þ û y WPMAS<C ' ,¼°_ Ö o p ú û UÄ: ; u ˜ – Í  ë 2,

6.

)

)

)

)

*

*

*

*

+

+

+

+

,

,

,

,

-

-

-

-

.

.

.

.

/

/

/

/

- . / 0 1 23
4 56 7 8 9 : ;—WPMAS,Ä: ;<> ?@8 9 @AB C 802.11
4 5,WPMASF\I J K  L M N O P ,I J •FÁ ± WPMASÜ Ý
4 5 ß T W X ‡ T ,ÄWPMAS• FÅ Ñ 
' ( ) Ò Ó Ô Õ Ö v × fg Ø Õ ' ( )– x Ù 7 Ú 7 , WPMASa  b c 5d q
FB C IEEE 802.11DE 4 5,
Ffg IEEE 802.11DE 4 5B C ; h ijk,
GH I J l / m / n X o p , WPMAS M ²  1 e f ‡ p   " ½  þ ~  ˜ – ,š4 5B C  : ;‡ p B C 4 5 ´ " ~ Û •"  }  f 4 5k4 ß T ® ¯ ,šI J Å \ : ;‡ p _ Ö o p ú û " Á ¼ _ Ö ŽÆ ! ~ Þ û y : ;,Û •   u <š WPMAS : ;l Þ } ” ^
4 5 WEP~ ‡  <Å Ü Ý
 Ü Ý J   ] ^
 … †   ,

0

1

0

0

1

1

0

1

 . / ! x   !  Ü " × ® ë NSC 94-2218-E-011-009@NSC 94-3114-P-001-001-Y@NSC 94-3114-P-011-001Õ Ö   ٠8 Õ Ö # ,. / $ % x   !  Ü " × ® & \g Ä'(,

2

3

4

5

2

2

3

3

4

4

5

5

2

3

4

5

[1] ANSI/IEEE Std 802.11, 1999 Edition.

[2] M. S. Gast, “802.11 Wireless Networks: The Definitive Guide”, O’REILLY Publisher April 2005.

[3] Wei-Ming Shi Lab, “Implementing Practice of Wireless”, Flag Publisher, July 2002.

[4] http://www.sniffer.com/ [5] http://www.networkview.com/ [6] http://www.sunrisetelecom.com/lansoftware/lanx plorer.shtml [7] http://www.slackware.org.tw/ [8] http://www.ethereal.com/ [9] http://reptile.rug.ac.be/~coder/index.html [10] http://www.wildpackets.com/ [11] http://www.kismetwireless.net/ [12] http://www.tw-wireless.com/ [13] http://pcmcia-cs.sourceforge.net/ [14] http://www.infinet.com.tw/product-1/Xtramus/