Wireless Sniffing4/4/02Nick Petroni <npetroni@cs.umd.edu>Overview: --------Recent changes in the LAN market have placed an emphasis on wirelessnetworking and specifically IEEE 802.11. As a result of the increasingpopularity of wireless, network administrators benefit from tools thatallow them to sniff, analyze, and audit wireless data frames. As apacket sniffer, logger, and IDS Snort can maintain all of itsfunctionality while using a wireless device as the listeninginterface. The provided changes allow Snort to sniff over a wirelessinterface in RFMON (RF Monitor) mode and to decode packets. Furtherchanges allow snort to be put in "wireless" mode with the '-w' flagin order to see all 802.11 frames.Regular Snort, wireless interface:---------------------------------To use Snort over a wireless interface in RFMON mode, simply set thecard to that mode and start snort with the usual -i <interface>flag. How is sniffing in RFMON mode different from sniffing inEthernet emulation mode (that is, the mode the card is usually in whenyou are operating on your own network)? In RFMON mode the card isassociated with no particular network, rather it listens to alltraffic it can see from any device using 802.11 within range. Similarto using different Virtual LANs on the same piece of wire, many 802.11networks operate in the same area. For those interested inmonitoring only their own network, it is recommended that they leavetheir wireless card in Ethernet emulation mode. This is no differentthan snort in the wired environment (and, in fact snort won't evenknow the difference). For those interested in monitoring all wirelessnetworks within range, RFMON mode should be used.Snort in wireless mode:----------------------IEEE 802.11 uses three types of frames: management, control, anddata. Without going into too much detail, control frames are used tosupport delivery of management and data frames. Management framesprovide a means for setting up and maintaining wireless associations(network connections). Data frames transport actual network messages(layer 3 and above). Contrary to the usual wired paradigm, networkadministrators are becoming increasingly concerned with layer 2 framesand associations due to the unbounded nature of the physicalmedium. For this reason, snort has a wireless mode in which all 802.11frames (including management and possibly control frames) aredisplayed. To use snort in wireless mode, simply use the '-w'flag. Along with the usual data frames, snort will also display anymanagement or control frames that are passed up by the card.Test Setup:----------In order to use snort in wireless mode, you will need a wireless cardand an associated driver that allows the card to be put in RFMONmode. Testing was done using a Cisco Aironet 340 PCMCIA card. Thereare multiple drivers available for this card. The one used for testingis available from http://airo-linux.sourceforge.net and works with thePCMCIA package included in the Linux kernel.   Packet Filters:--------------Because of the nature of wireless communication, the medium isconstantly filled with packets, even when data is not beingtransferred. Management and control frames, especially Access PointBeacons, tend to dominate traffic being captured in RFMON mode. Forthis reason, users may benefit from capture filters. Since BPF waswritten before the recent boom of wireless LANs there are no keywordsavailable for the 802.11 MAC. However, one commonly desired filter isto do so by frame type. This can easily be achieved using linkoffsets, since the first byte of a wireless frame indicates itstype. For example, a user wanting to run snort in wireless mode, butwanting to filter out all beacons could run snort -w -i <interface> -v -X link[0] != 0x80This is because beacon frames will have a first byte of0x80.