In this lecture we’ll discuss Wireless Modes of Operation. WiFi or IEEE 802.11 (eight-oh-two-dot-eleven)
defines the following modes of operation for wifi cards:
AP, infrastructure or master mode!
The wireless card creates a network with a specified name (called the SSID) and channel and offers
network services on it. Wireless cards in master mode can only communicate with cards that are associated
with it in managed mode.
These are the names,
SSID or service set
identifiers, of all networks in the range. In the managed aka. Client Mode wireless cards will join
a WiFi network created by an AP and will automatically change their channel to match the channel of that
WiFi network. Managed mode cards do not communicate with each other directly and will only communicate
with an associated master.
Then there is the Ad -hoc mode. In the Ad-hoc mode
there is no master, access point or a wireless router.
Each wireless card communicates directly with its neighbors.
Notes must be in range of each other to communicate and must agree on a network name and channel. And
finally the Monitor Mode. Monitor Mode, RFMON or Radio Frequency Monitor mode, allows a wireless
card to monitor all traffic received on a wireless channel. Monitor Mode allows packets to be captured
without having to first associate with an access point.
Do not confuse it with the Promiscuous Mode used for sniffing. A wireless card can be put in promiscuous
mode after associating with an AP and will sniff the traffic of the WiFi network to which is associated.
The Monitor Mode works by sniffing the packets in the air without associating or linking with any
access point. Monitor mode is not used for normal communication but only for troubleshooting or hacking
wireless networks. At this moment
The WiFi card of the Windows machine I'm using to record this video is in Managed Mode; it's associated
and authenticated to an AP which is also the router of the LAN, this one called CMA.
If I start sniffing on this interface it will capture only data packets destined to it, it won't capture
other wireless frames like Management or Control Frames, only data frames. I'm starting capturing WiFi
traffic.
Note that there are many types of packets, not only data packets in WiFi networks such as beacons,
association requests and responses, authentication requests and responses, requests to send and clear to
send and many more.
Look we see only data packets; there are no because, association or authentication packets captured.
In addition the radio header of the frame is converted to what is called a fake Ethernet header.
This is the fake Ethernet Heather; so in fact we don't see the full layer to header of the WiFi packet
because many fields have been removed.
This is not the real layer 2 header of the frame.
Note that I've used the terms packet and frame interchangeable.
Normally a frame is a L2 PDU and a packet is a Layer3 PDU
so when referring to the wireless and Ethernet protocols which are L2 protocols the correct
term is frame
but I think there is no such a big mistake if we call them packets
sometimes. Now let's go ahead and put the wireless interface into monitor mode.
Remember that you cannot use Monitor Mode on Windows.
I'd recommend you to watch the previous videos where I've explained how to check if the WiFi card supports
the Monitor Mode or not.
For this lab I'm gonna use Kali Linux. There are more ways to enable the monitoring mode and I'll show
you two of them.
The first one will use airmon-ng and the second one
iwconfig.
This is the WiFi interface which is associated to an AP. The first step is to stop the processes that
could cause troubles while working with the interface in Monitor Mode.
I'm running airmon-ng check to list all possible processes like the network manager that could
interfere with the WiFi card. If it says "airmon-ng command not found"
that means that you have not installed aircrack-ng,
the program which contains airmon-ng. On Kali Linux it's already installed but on Ubuntu, Linux
Mint or other Linux distributions you can install it by executing a apt install aircrack-ng.
This is how you install it on Ubuntu
for example.
And it found two processes that could cause trouble.
Now I'll try to kill them: airmon-ng check kill.
It's killing the processes
Let's check it again.
No process will interfere with my interface so I'll put it into Monitor Mode: airmon-ng start
and the name of the interface.
In this example the name of the interface is wlen0. Check the name of your interface before executing
this command.
You can run
ifconfig before killing these processes.
The tool has created a new interface called wlan0mon which is in Monitor Mode.
This is the interface; it's the old name wlan0 and mon.
You can check it also by executing iwconfig; Xit's like ifconfig but for WiFi cards; and it's in Monitor
Mode.
Now if we start a packet capture tool like Wireshark or tcpdump we will select that interface to capture
packets and it will capture all packets on the shared medium. so tcpdump -i and the name of the
interface wlan0mon and we see all WIFi traffic in the range.
I am stopping it by pressing ctr c
To return the interface to normal
we need to disable Monitor Mode as following airmon
-ng stop
wlan0mon
and iwconfig. It's showing that the interface is in Managed Mode and its name is wlan0. Let's see
the second method used to put the interface in monitor mode.
The first step is to disable the WiFi interface.
ifconfig wlen0 down then I'll use iwconfig like this: iwconfig wlan0 mode monitor
and finally I'm enabling the interface ifconfig wlan0 up
Now the interface is running in Monitor Mode. Let's start capturing packets on the interface,
this time with Wireshark.
And I'm starting capturing packets on the interface in Monitor Mode and we notice how it's capturing
all the WiFi traffic.
Note that the interface is not authenticated or associated with any AP. It's just capturing all the traffic
including management and control packets, not only data packets from all clients and wireless routers
in its range; note that the medium which is the air is shared
so if a device like a mobile phone is surfing the web at another floor
the packets are reaching this point too and are captured. Of course they are encrypted but this is another
discussion. I'm stopping the capture. Also notice how it captured beacons and all kinds of WiFi traffic,
not only data.
And if we are searching for a data packet and take a deeper look,
this is data packet,
we also notice the radio header, not the fake Ethernet header like in the example from the beginning
of this lecture,
when I've captured packets with the interface in the managed mode.
This is the radio header.
And the final note:
if you need to restart the network manager use systemctl
start NetworkManager.