3

I have the understanding that wireshark has the capability to identify whether or not an Access Point (via Beacon frames or Probe Responses) is configured for WPS or not.

Particularly under the wireless management frame there is a tagged parameter --> "Tag: Vendor Specific: Microsoft: WPS" the holds the information element --> "Wifi Protected Setup State: Configured 0x02".

I understand that value: 0x02 indicates that this AP is indeed configured for WPS (specified in WPS protocol specification).

Now my question is the part that specifies "vendor specific" Microsoft. Does this indicate that this particular implementation of WPS is Microsoft specific? If so are there other vendors that implement this feature and how do I find out. I have sample data from my WIFI card, but I have not noticed any other vendors besides Microsoft. Does Microsoft have a monopoly on this technology? Is this something wireshark does by default? I'm pretty sure I'm missing something here, any information would be of great help.

Screenshot of wireshark 802.11 Beacon Frame

Jakuje
  • 24,773
  • 12
  • 69
  • 75
jv74
  • 153
  • 3
  • 8

1 Answers1

4

Microsoft have loaned their OUI (00-50-F2) out for a number of Wi-Fi Alliance specifications; perhaps WPS is one of them (along with Wi-Fi Multimedia Extensions and Wi-Fi Protected Access).

I'd check the IBSS with Wi-Fi Protected Setup Technical Specification v1.0.0 to see if that's the case, but it requires that I have a login to access "premium content", and "premium" probably means "notfree-as-in-beer" and I don't know whether "not free-as-in-beer" means "we charge a not-too-expensive fee for the specification", "we charge a too-expensive fee for the specification", or "we charge a membership fee so you'll keep paying, year by year, for your desire to read that one specification.

And when I tried to create a login anyway, it informed me that "You have attempted to reach a URL that no longer exists on salesforce.com." However, they sent me a mail to reset the password for my account - I'd already supplied them with a password for it, but I guess this is the way they get first-time users. After doing that, giving the account a brand-new password, they proceeded to send me to a page that looped infinitely between two pages. Quality with a capital KW, as a friend would say....

At least they don't appear to be charging me for the privilege.

However, I could return to the page for the specification in question and open it now. It does mention "IWSC OUI value of hex 00-50-F2-10", which is not an OUI value, as it's 4 octets, but it does begin with Microsoft's 00-50-F2 OUI. "IWSC" is "Wi-Fi Simple Configuration for IBSS"; the "Wi-Fi Simple Configuration" specification says "In the Wi-Fi Simple Configuration Information Element, the Element ID has a value of 221 and OUI is hex 00 50 F2 04." Again, that's Microsoft's 00-50-F2 OUI followed by an extra octet. They also speak of the "Wi-Fi Alliance OUI of 00 50 F2 04", so I guess Microsoft gave or loaned that OUI to the Wi-Fi Alliance. The IEEE's registry still says it belongs to Microsoft, so presumably it was loaned, and perhaps Wireshark's manuf file should indicate that it's a Microsoft OUI but loaned to to the Wi-Fi Alliance.

(And the Wi-Fi Protected Access spec I found I'd saved also speaks of that Microsoft OUI being used.)

So it's probably not Microsoft-specific.

  • Ah yes thank you, I am in possession of that spec. I was able to find the section you are talking about (in the Management Frames). This helps a lot thank you for the help. – jv74 Apr 15 '16 at 13:42