I'm trying to audit a home wifi LAN without the use of the router, which is provided by the ISP and does not have sufficient end-user functionality. It seems the word audit is most often used to mean penetration testing but that is not what I am trying to do. I want to put a wireless receiver into promiscuous + monitor mode and keep a log of some/all the packets flying around on a particular WPA encrypted network.
To that end I've been using
tshark; the information I'm logging is like this:
[Timestamp] [Destination MAC] [Source IP] [Size] [Source Port] [Dest Port] [Protocol Layers]
That's all I need. Unfortunately there are two complications:
In order to decrypt the packets, tshark must observe when each device logs onto the network. Since some of the devices are there 24/7, this means I have to start tshark then turn the entire network on and off to force everything to re-attach. That's fine, but...
Tshark is in fact not intended for this purpose. Because it is used for much more in depth packet analysis, it intrinsically keeps certain information in memory. This store grows larger and larger and apparently cannot be cleared or stopped. Eventually the system runs out of memory and the OS kernel kills the tshark process. This takes about 6-8 hours on a 1 GB RAM device.
Tshark is fed by dumpcap, so I've been considering just running dumpcap and storing the packets (~1 GB/hour) for subsequent analysis. But since all I need is some information readily available in the headers, this seems pointless -- if it weren't for the WPA encryption, I could quickly write something to do this myself that would occupy very little memory and could be run perpetually.
So I'm looking for something that does exactly that -- or even something that will just do the decryption.1 The systems I'm using for monitoring are low power, linux ARM based devices, so it likely must be something that can be compiled from source.
1. In fact I just found one, but a more complete solution would be good.