Wireshark-dev: Re: [Wireshark-dev] Student Project. I want to reduce and add some functionaliti

From: Jaap Keuter <jaap.keuter@xxxxxxxxx>
Date: Wed, 21 Dec 2011 09:14:53 +0100
On 2011-12-21 05:39, Yohannes Affandy Siregar wrote:

Greetings fellow developers!

I'm a student taking Electrical Engineering specializing Computer
Engineering and am still learning a lot about Wireless and Programming..
I'm working on my last project in University.

I now have to make a packet sniffer program which utilizes wireless
adapter in my laptop to read an RFID tag using 802.11 b/g protocol.
Using Backtrack 4 r2 as my OS, I could put my wifi adapter into monitor mode and then used Wireshark to read the presence of the tag. It transmits probe request and data inside it.. I already could see it. But, that's not enough. Now, my professor wants me to make Wireshark to read only my tag and not other WAP. Also he wants it to read the tag just once in a period of time. and, I need to parse the MAC address of the tag too.. my sniffer program has to proceed the MAC Address of the tag to a database
center.

Can I change the source code of Wireshark to do those things: reads only from specific type of clients, filters MAC address so that no same MAC address recorded, and proceeds the MAC address and info in the tag to a
database server? Has anyone ever done this before?

Thank you very much...

Sincerely yours,
Yohannes A. Siregar

Hi,

.... Now, my professor wants me to make Wireshark to read only my
tag and not other WAP.

How do you identify 'my tag' apart from all other transmissions?
Assuming by MAC address you can setup a capture filter for it.


Also he wants it to read the tag just once in a period of time.

Assuming you filtered away all other traffic you could setup a display
filter for that, working of the frame delta time.


and, I need to parse the MAC address of the tag too.

Which brings us back to the first question: how to identify your tag
if you can't work from the MAC address?


my sniffer program has to proceed the MAC Address of the tag to a database
center.

Wireshark does GUI output, not helpful in this case. What you should look at then in tshark. It does the same thing, just text based. Much easier for
online processing of captured info.

Thanks,
Jaap