Analysing Wireless Network Traffic

Question 1

Proper uses of packet sniffing

Answer 1

• troubleshooting,
• application performance
• monitor consumption trends on a network
• useful in increasing network security

Question 2

Improper use of packet sniffing

Answer 2

It is a type of attack in which attacker captures packets across a wired connection or wireless connection. The main aim is to capture unencrypted credentials from the network. The common protocols which can be targetted using such attack are FTP, HTTP, SMTP, NNTP, POP, IMAP, Telnet etc.

Question 3

Active sniffing

Answer 3

In this sniffing type, attacker directly interacts with target machine by sending packets and receiving responses.
This sniffing is carried out through Switch. In this type, attacker tries to poison the switch by sending bogus MAC address.

Examples of active sniffing : ARP spoofing, MAC flooding, HTTPS and SSH spoofing, DNS spoofing etc.

Question 4

Passive sniffing

Answer 4

In this sniffing type, attacker does not interact with the target. He/she simply hook on to the network and captures packets transmitted and received by the network or exchanged between two machines.

This sniffing is carried out through hub. An attacker connects to the hub from his/her machine. Attacker needs account on the LAN.

Examples of passive sniffing: Hub based networks or wireless networks

Question 5

802.11 Frame types

Answer 5

• Management Frames
• Control Frames
• Data Frames

Question 6

Management Frame types

Answer 6

• Association Request/Response
• Reassociation Request/Response
• Probe Request/Response
• Beacon
• Authentication
• Disassociation
• Deauthentication
• Action

Question 7

Control Frame types

Answer 7

• Request to send (RTS)
• Clear to Send (CTS)
• Acknowledgement (ACK)

Question 8

Data Frame types

Answer 8

• QoS Data
• Null Data / QoS Null Data

Question 9

MAC Address

Answer 9

A MAC address is a string of characters that identifies a device on a network. It’s tied to a key connection device in your computer called the network interface card, or NIC.

Question 10

Service Set Identifier (Same as ESSID)

Answer 10

A service set identifier (SSID) is a sequence of characters that uniquely names a wireless local area network (WLAN). An SSID is sometimes referred to as a “network name.” This name allows stations to connect to the desired network when multiple independent networks operate in the same physical area.

Question 11

Basic Service Set

Answer 11

Basic Service Set (BSS), as the name suggests, is basically a network topology that allows all wireless devices to communicate with each other through a common medium i.e. AP (Access point). It also manages these wireless devices or clients. It basically provides a building block to all wireless LAN (Local Area Network). BSS basically contains only one AP that is connected to all stations i.e. all wireless devices within the network.

Question 12

Basic Service Set Identifier

Answer 12

BSSID stands for Basic Service Set Identifier, and it’s the MAC physical address of the access point or wireless router that is used to connect to the WiFi.

Question 13

Extended Service Set

Answer 13

An extended basic service set (ESS) consists of all of the BSSs in the network. For all practical purposes, the ESSID identifies the same network as the SSID does.