4

I'm trying to audit a home wifi LAN without the use of the router, which is provided by the ISP and does not have sufficient end-user functionality. It seems the word audit is most often used to mean penetration testing but that is not what I am trying to do. I want to put a wireless receiver into promiscuous + monitor mode and keep a log of some/all the packets flying around on a particular WPA encrypted network.

To that end I've been using tshark; the information I'm logging is like this:

[Timestamp] [Destination MAC] [Source IP] [Size] [Source Port] [Dest Port] [Protocol Layers]

That's all I need. Unfortunately there are two complications:

  • In order to decrypt the packets, tshark must observe when each device logs onto the network. Since some of the devices are there 24/7, this means I have to start tshark then turn the entire network on and off to force everything to re-attach. That's fine, but...

  • Tshark is in fact not intended for this purpose. Because it is used for much more in depth packet analysis, it intrinsically keeps certain information in memory. This store grows larger and larger and apparently cannot be cleared or stopped. Eventually the system runs out of memory and the OS kernel kills the tshark process. This takes about 6-8 hours on a 1 GB RAM device.

Tshark is fed by dumpcap, so I've been considering just running dumpcap and storing the packets (~1 GB/hour) for subsequent analysis. But since all I need is some information readily available in the headers, this seems pointless -- if it weren't for the WPA encryption, I could quickly write something to do this myself that would occupy very little memory and could be run perpetually.

So I'm looking for something that does exactly that -- or even something that will just do the decryption.1 The systems I'm using for monitoring are low power, linux ARM based devices, so it likely must be something that can be compiled from source.

1. In fact I just found one, but a more complete solution would be good.

Improve this question

1 Answer 1

Reset to default
1

Depending on the WiFi devices you can often do this sort of thing with scapy and the processing and retention of the data is highly configurable.

Scapy is written in python so can be run from source but does depend on some libraries - see the documentation.

Improve this answer
5
  • I'm not so sure -- a catch about putting a wifi receiver (or at least, all the ones I've tried) into monitor mode (which is in addition to promiscuous mode) is that it can't be used as an interface at the same time. I.e., if scapy only deals with actually connected interfaces, it won't work. I'd be happy to process packets myself otherwise, since using an actually connected interface would get around the need for WPA decryption. But connected wifi devices can't be in monitor mode and, unlike ethernet NIC's, they cannot capture everything in promiscuous mode.
    – goldilocks
    Apr 25, 2015 at 16:41
  • hackoftheday.securitytube.net/2013/03/…
    – Steve Barnes
    Apr 25, 2015 at 17:50
  • Yeah, I looked at a few posts there involving scapy. But again, I don't see any indication that it is capable of WPA decryption. Put slightly differently: As far as I can tell scapy does not do WPA decryption. All of those blogs, etc., are connecting to a device that is either connected to the network, in which case scapy receives the packets in userland decrypted, or else they are on a network with no encryption. In order to catch all the traffic, as per my last comment, the interface can't be on the network...
    – goldilocks
    Apr 25, 2015 at 18:08
  • ...and therefore the packets it receives (which could be from any SSID in range) are passed undecrypted to userland. There are endless tools, libraries, etc. to analyze unencrypted packets, but there seems to be very few to perform WPA decryption first. That's my problem. If you search "scapy wifi" you'll find plenty of stuff, but if you search "scapy WPA" you get pretty much nothing; since it would be considered a significant feature, someone somewhere, or some piece of documentation, would have made it known.
    – goldilocks
    Apr 25, 2015 at 18:09
  • In fact, searching scapy's home domain (which includes all the docs) for "WPA" turns up nothing.
    – goldilocks
    Apr 25, 2015 at 18:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.