Ethereal-users: Re: [Ethereal-users] wrong data when sniffing 80211 with WEP

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Joe Tomasone <joe@xxxxxxxx>
Date: Wed, 19 Dec 2001 11:41:35 -0500
In my experience, none of the 802.11 vendors properly follow the spec.
The spec calls for all WEP-encrypted packets to have the privacy bit set in the header of each data frame. They do not. You can verify this while looking at any WEP-encrypted frame. The AP will have it's privacy bit set in the beacon frames, but the data packets look like normal. I suppose the AP's/STA's simply assume it's WEP if the AP supports it and go on that. 

        - Joe



At 07:47 AM 12/12/2001, you wrote:


Hi
After I have managed to get Ethereal to work with Aironet in rfmon mode, I did some sniffing of my own WLAN. 



I noticed that the data starting from WEP[ie.e IVs and the Key ID] is wrong.
I have got Airopeek running concurrently and compared the capture from the two proggies. 



I am using Ethereal 0.8.20, and Libpcap CVS in RH 7.2.



Anyone got similar experiences?



darren


----------
This message has been 'sanitized'. This means that potentially dangerous content has been rewritten or removed. The following log describes which actions were taken. 



Sanitizer (start="1008161143"):
  Part (pos="1071"):
    SanitizeFile (filename="unnamed.txt", mimetype="text/plain"):
      Match (rule="2"):
        Enforced policy: accept

  Part (pos="1579"):
    SanitizeFile (filename="unnamed.html", mimetype="text/html"):
      Match (rule="default"):
        Enforced policy: accept
Rewrote HTML tag: >>_META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"_<< as: >>_MANGLED_ON_PURPOSE_META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"_<< 
    Rewrote HTML tag: >>_meta name=ProgId content=Word.Document_<<
as: >>_MANGLED_ON_PURPOSE_meta name=ProgId content=Word.Document_<< 
    Rewrote HTML tag: >>_meta name=Generator content="Microsoft Word 10"_<<
as: >>_MANGLED_ON_PURPOSE_meta name=Generator content="Microsoft Word 10"_<< 
    Rewrote HTML tag: >>_meta name=Originator content="Microsoft Word 10"_<<
as: >>_MANGLED_ON_PURPOSE_meta name=Originator content="Microsoft Word 10"_<< Rewrote HTML tag: >>_link rel=File-List href="cid:[email protected]"_<< as: >>_MANGLED_ON_PURPOSE_link rel=File-List href="MANGLED_ON_PURPOSE_cid:[email protected]"_<< 
    Rewrote HTML tag: >>_style_<<
                  as: >>_MANGLED_ON_PURPOSE_style_<<
    Rewrote HTML tag: >>_style_<<
                  as: >>_MANGLED_ON_PURPOSE_style_<<
Rewrote HTML tag: >>_body lang=EN-US link=blue vlink=purple style='tab-interval:.5in'_<< as: >>_body lang=EN-US link=blue vlink=purple MANGLED_ON_PURPOSE_style='tab-interval:.5in'_<< 
    Rewrote HTML tag: >>_span style='font-size:10.0pt; font-family:Arial'_<<
as: >>_span MANGLED_ON_PURPOSE_style='font-size:10.0pt; font-family:Arial'_<< 
    Rewrote HTML tag: >>_span style='font-size:10.0pt; font-family:Arial'_<<
as: >>_span MANGLED_ON_PURPOSE_style='font-size:10.0pt; font-family:Arial'_<< 
    Rewrote HTML tag: >>_span style='font-size:10.0pt; font-family:Arial'_<<
as: >>_span MANGLED_ON_PURPOSE_style='font-size:10.0pt; font-family:Arial'_<< 
    Rewrote HTML tag: >>_span style='font-size:10.0pt; font-family:Arial'_<<
as: >>_span MANGLED_ON_PURPOSE_style='font-size:10.0pt; font-family:Arial'_<< 
    Rewrote HTML tag: >>_span style='font-size:10.0pt; font-family:Arial'_<<
as: >>_span MANGLED_ON_PURPOSE_style='font-size:10.0pt; font-family:Arial'_<< 
    Rewrote HTML tag: >>_span style='font-size:10.0pt; font-family:Arial'_<<
as: >>_span MANGLED_ON_PURPOSE_style='font-size:10.0pt; font-family:Arial'_<< 
    Rewrote HTML tag: >>_span style='font-size:10.0pt; font-family:Arial'_<<
as: >>_span MANGLED_ON_PURPOSE_style='font-size:10.0pt; font-family:Arial'_<< 
    Rewrote HTML tag: >>_span style='font-size:10.0pt; font-family:Arial'_<<
as: >>_span MANGLED_ON_PURPOSE_style='font-size:10.0pt; font-family:Arial'_<< 
    Rewrote HTML tag: >>_span style='font-size:10.0pt; font-family:Arial'_<<
as: >>_span MANGLED_ON_PURPOSE_style='font-size:10.0pt; font-family:Arial'_<< 
    Rewrote HTML tag: >>_span style='font-size:10.0pt; font-family:Arial'_<<
as: >>_span MANGLED_ON_PURPOSE_style='font-size:10.0pt; font-family:Arial'_<< 
    Rewrote HTML tag: >>_span style='font-size:10.0pt; font-family:Arial'_<<
as: >>_span MANGLED_ON_PURPOSE_style='font-size:10.0pt; font-family:Arial'_<< 
    Rewrote HTML tag: >>_span style='font-size:10.0pt; font-family:Arial'_<<
as: >>_span MANGLED_ON_PURPOSE_style='font-size:10.0pt; font-family:Arial'_<< 
    Rewrote HTML tag: >>_span style='font-size:10.0pt; font-family:Arial'_<<
as: >>_span MANGLED_ON_PURPOSE_style='font-size:10.0pt; font-family:Arial'_<< 
    Total modifications so far: 21
Anomy 0.0.0 : Sanitizer.pm $Id: Sanitizer.pm,v 1.32 2001/10/11 19:27:15 bre Exp $