7

I'm developing a IEEE802.11 frame parser program using libpcap inside Linux with raw C. I can parse RadioTap and IEEE802.11 headers easily but I can't find out the protocol name which is encapsulated inside the IEEE802.11 MPDU. Unfortunatly there isn't any field in IEEE802.11 header indicating the encapsulated protocol (like protocol field in Ethernet header).

Any solution?

SuB
  • 2,250
  • 3
  • 22
  • 37
  • What do you mean with name? b/g/n... can be retrieved on PLCP Sublayer – LPs Mar 16 '17 at 13:14
  • @LPs: b/g/n is part of `IEEE802.11` header. I mean `802.11X` in the case of `EAPOL` packets in WPA authentication or any other protocol encapsulated inside the packet. – SuB Mar 16 '17 at 13:23
  • I am no expert, but looking into wireshark [sample captures](https://wiki.wireshark.org/SampleCaptures#Wifi_.2F_Wireless_LAN_captures_.2F_802.11) reveals, that there may be a Logical-Link-Control header with SNAP extensions (as indicated by 0xAA) which may contain [ettertype](https://en.wikipedia.org/wiki/EtherType) when OID==0x000000 (see [here](https://en.wikipedia.org/wiki/Subnetwork_Access_Protocol))...Good luck! – vlp Mar 22 '17 at 22:33
  • Found [a nice picture](http://flylib.com/books/en/2.519.1.29/1/). (And to clarify -- I am talking about 'Data frames' which are recognised with frame control field) – vlp Mar 22 '17 at 22:46
  • 1
    off-topic because... This question does not appear to be about programming within the scope defined in the help center. – sigjuice Mar 28 '17 at 14:51

2 Answers2

2

For 802.11 frames that are encapsulating data, the header type/subtype will be between 0x20 and 0x2F (although the frame is usually 0x20 (Data) or 0x28 (QoS-Data)). There will be a 5-byte SNAP header which will contain the type of payload (as mentioned in this answer). If the OID (first three bytes of the SNAP header) is 0x000000, then the next two bytes are the Ethernet Type.

The Ethernet Type would be 0x888e for EAPoL (source). That is the field you would inspect to know the encapsulated protocol (0x0800 for IP, 0x0806 for ARP, etc.).

Here is a good Cisco doc on Ethernet types and how you can use them to filter certain protocols: http://www.cisco.com/c/en/us/td/docs/ios/12_2/ibm/vol1/command/reference/fibm_r1/br1fethc.pdf.

Here is a good Cisco doc on wireless sniffer traces that include a description of the 802.11 type/subtype fields: https://supportforums.cisco.com/document/52391/80211-frames-starter-guide-learn-wireless-sniffer-traces.

Community
  • 1
  • 1
Greg Schmit
  • 4,275
  • 2
  • 21
  • 36
2

Data of IEEE802.11 data packets is encapsulated in a LLC header (See here):

An 802.11 frame should contain an LLC header if, and only if, it's a Data frame. The frame type and subtype are part of the Frame Control field in the MAC header; Data is one of the frame type values (the others are Control and Management). The subtype doesn't matter - all Data frames should contain an LLC header, and no other frames should.

There are two kinds of LLC header: 3 bytes, 8 bytes . IEEE 802.11 uses the second one (See here). In that one, the two last bytes of LLC header is equivalent to Ether Type field in Ethernet protocol. So 0x800 for this field means IPv4 for example.

SuB
  • 2,250
  • 3
  • 22
  • 37