Download practical packet analysis practical packet analysis

Physical Considerations
The first thing to consider about capturing and analyzing data transmitted
across a wireless network is the physical transmission medium. Until now, we
have not considered the physical layer, because we’ve been communicating
over physical cabling. Now we are communicating through invisible airwaves,
with packets flying right by us.
Sniffing One Channel at a Time
The most unique consideration when capturing traffic from a wireless local
area network (WLAN) is that the wireless spectrum is a shared medium. Unlike
wired networks, where each client has its own network cable connected to a
switch, the wireless communication medium is the airspace client’s share, which
is limited in size. A single WLAN will occupy only a portion of the 802.11
spectrum. This allows multiple systems to operate in the same physical area
on different portions of the spectrum.
NOTE
Wireless networking is based on the 802.11 standard, developed by the Institute of
Electrical and Electronics Engineers (IEEE). Throughout this chapter, the terms wireless network and WLAN refer to networks that adhere to the 802.11 standard.
This separation of space is made possible by dividing the spectrum into
operation channels. A channel is simply a portion of the 802.11 wireless spectrum. In the United States, 11 channels are available (more are allowed in
some other countries). This is relevant because, just as a WLAN can operate
on only one channel at a time, we can sniff packets on only one channel at
a time, as illustrated in Figure 11-1. Therefore, if you are troubleshooting a
WLAN operating on channel 6, you must configure your system to capture
traffic seen on channel 6.
Wireless Client
1
2
3
4
5
6
7
8
9
10
11
Wireless
Access Point
Wireless Spectrum
(11 Channels)
Figure 11-1: Sniffing wirelessly can be tedious, since it can be
done on only one channel at a time.
NOTE
216
Chapter 11
Traditional wireless sniffing can only be done one channel at a time, with one exception:
Certain wireless scanning applications utilize a technique called channel hopping to
change channels rapidly in order to collect data. One of the most popular tools of this
type, Kismet (http://www.kismetwireless.net/), can hop up to 10 channels per
second, which makes it very effective at sniffing multiple channels at once.