Forum

Just reading the forward about the book on how technical this exam and topic is and how the 802.11 frames are more difficult to anlayze from ethernet. I agree as a former CNX. But what I found funny from my sense is that back in 1994 I was studying several books and docs about 802.5 token ring frames, mac management frames and all the fields, functions and state machines especially with RSB and BEACON frames then. I was supporting a 10,000+ tokenring bridge lan/wan. I had to be a Token Ring expert to support this stuff and solve problems.

And here I am today studying another frame format just as compicated or even more and there are BEACON frames.

I thought I was done with, synchronization(AM/SM) polling and beacons when Token Ring went by the wayside :)))))))

Same names but different functions in some cases.

Funny

I'm not sure I'd call supporting a 10,000+ node token ring network funny..... ;-D If I were to try to imagine what hell will be like, I couldn't imagine anything much closer than that.

You're right though, when a person keeps digging and digging for their next technology fix, they usually get high studying the lowest OSI layers. MAC frames just won't go away. :)

Devinator

so true so true, you had to have a sense of humor with all the novell print servers, ipx sap based broadcast storms, cisco and ibm based tokeing ring rsb/spanning tree loops and broadcast storms, ibm bridges, large and I mean large cisco router rip and ipx rip network meltdowns at times, throw in some nds, custom applications, lotus notes, windows 3.11, fddi backbones, netbeui, novell server farms and redudant ibm 3745 feps with token ring nics at the time and yikes.... man you would not beleive how many tokeing ring polling problems I had to solve using a the dos based sniffer to track the corrupted madge card mac who was shorting the am/sm polling on the ring...

What was cool about token-ring's mac was its command set. If I wanted to remove a station from the ring all I had to do was send a mac frame with the remove ring station command to the station I wanted to remove and the station would de-insert.

I am wondering if I can do the same thing with an 802.11 frame. send an 802.11 fram to the ap with the deassociate management sub command and possibly the aid. I have to try this in the lab. I am having a problem finding a good 802.11 packet generator.

polling
beacons
synchronization timers
mac frame fields

ugggg it is 1994 all over again

regards..

There's currently no good 802.11 frame generator. We're hoping that one of the protocol analyzer companies might decide to build us one. You can send deauthentication frames to bump nodes off the network. Just send a unicast frame to their MAC with a spoofed source of the AP to which they're associated, and voila.

devinator

Thanks that's what I thought after reading some books about 802.11 mac frame details.

I agree no frame generators out there. I was working with link ferret and with network chemistry a year or so back asking for this.

I have an older wsp100 for packetyzer and it does have a frame editor but the wsp100 was, I recall, 100% passive, but I will have to test again..

In the libnet world there was a libradiate project back in 02 but it was discontinued. I hear that a newer 802.11 libnet based api is on the way but it is just hearsay.

must....generate....packets

I posted as guest again, aggg

here is the link to radiate 0.2 for those interested.

http://www.packetfactory.net/projects/libradiate/

I heard commview for wifi has a packet generator but am not sure. Can anyone confirm?

badger11 Escribió:

I heard commview for wifi has a packet generator but am not sure. Can anyone confirm?

thanks for the heads up badger11 I contacted commview and here is the query and answer:

I am looking for a new wifi sniffer for application analysis and security testing. I have worked with linkferret and packetyzer.

Does your product have the ability to edit a frame and replay it back into the air?
Can I resend frames from the capture buffer or resend edited frames?

Commview reply:

This feature will be available only in our new release of CommView for WiFi 5.0, which we are going to introduce at late November. Please check our web site for new release or subscribe for our news letter to be informed:

http://www.tamos.com/subscription/




Tamosoft