IT 530 Unit 4 Assignment Lab
Caution! Do not install or run the Wireshark packet capture and analyzer on any workplace system without written permission, signed by your supervisor! You are strongly encouraged to only use Wireshark on personally owned equipment.
Before beginning the lab, it is recommended that you read the 802.11 Tutorial document in Doc Sharing for a better understanding of 802.11 (wireless) packet behavior and packet types.
Because not all students will be able to capture wireless packets with their own computer system, a Wireshark “trace” file is provided in Doc Sharing for this lab; look for the Wireshark 802_11 file with the “pcap” file extension.
1. Download the Wireshark 802_11 trace file from Doc Sharing.
2. Start Wireshark. From the menu, select File, then Open and browse to where you have downloaded the trace file and select it to open it.
3. On page 12 of the 802.11 Tutorial (Doc Sharing), read the description of Beacon frames. Beacon frames are used by wireless access points to let other wireless nodes in the area know that the access point is available and is ready to synchronize with other nodes.
4. Study the Wireshark 802_11 trace file; in the “Info” column, you should be able to see the “Beacon frame” packets.
5. Click once on the No. 1 Beacon frame packet to select it.
6. In the “detail” panel just below the numbered packets panel, click on the small plus signs to expand the information contained within the packet.
a. Note down the destination address (in hexadecimal) and the source address (also in hexadecimal).
b. Note down the channel type.
7. In the top panel, scroll down to packet No. 1011.
8. Click once to select the packet.
9. In the “detail” panel just below the numbered packets panel, click on the small plus signs to expand the information contained within the packet.
a. Note down the source IP address.
b. Note down the destination IP address.
c. Note down the source port.
d. Note down the destination port.
10. In the top panel, scroll down to packet No. 1740.
11. Click once to select the packet.
a. What type of packet is this? (Hint: look in the Info column).
12. In the “detail” panel just below the numbered packets panel, click on the small plus signs to expand the information contained within the packet.
a. Note down whether or not the data in the packet is protected.
b. Note down the Authentication Algorithm.
c. Note down the source address (in hexadecimal).
d. Note down the destination address (in hexadecimal).
13. In the top panel, scroll down to packet No. 1750.
14. Click once to select the packet.
a. What type of packet is this?
15. In the “detail panel”, click on the small plus signs to expand the information contained within the packet.
a. Note down the source address (in hexadecimal).
b. Note down the destination address (in hexadecimal).
c. Note the types of cipher suite and authentication keys that the source can support.
Deliverables for this lab:
1. A screenshot of the Wireshark interface displaying the AUTHENTICATION packet.
2. The channel type for the BEACON frame.
3. The source and destination IP addresses for the TCP packet.
4. The source and destination port numbers for the TCP packet.
5. The state of protection for the AUTHENTICATION packet.
6. The Authentication Algorithm in use by the AUTHENTICATION packet.
7. Is the AUTHENTICATION packet being sent by a client system? Or the access point?
8. What types of cipher suite and authentication keys are available in the ASSOCIATION packet?
9. Is the ASSOCIATION packet being sent by a client system? Or the access point?
10. A brief (two or three paragraphs) analysis of the traffic behavior as shown in the capture.
