Professional Documents
Culture Documents
ECNG 3002
Data Communication Systems
813001122
Ronald Ramsaroop
Wireshark Lab #1
802.11
Figure 1: Source MAC address for beacon frame from 30 Munroe St.
1.4.2.4
The destination MAC address on the beacon frame from 30 Munroe St. is: ff: ff: ff: ff: ff: ff
Wireshark Lab #1
802.11
1.4.2.5
The MAC BSS Id on the beacon frame from 30 Munroe St. is: 00:16:b6:f7:1d:51
1.4.2.6
The four data rates supported by the 30 Munroe St. Access point are as follows: 1(B), 2(B),
5.5(B), 11(B). These rates are given in Mbit/sec.
The eight additional "extended supported rates" are as follows: 6(B), 9, 12(B), 18, 24(B), 36, 48,
54. These rates are given in Mbit/sec.
Both sets of rates are shown in the screenshot below.
Figure 4: Data rates supported by the beacon frame from access point 30 Munroe St.
The 802.11 frame containing a SYN TCP segment for the first TCP session is shown highlighted in
blue in the screenshot below. This TCP SYN segment was sent at 24.811093 seconds.
Wireshark Lab #1
802.11
This segment is known to be the SYN TCP segment because the SYN flag has been set to 1, as
shown in the screenshot below.
1.4.3.7a
The three MAC address fields are the BSSid, the source address and the destination address.
These are the standard three addresses in an 802.11 frame.
1.4.3.7b
The MAC address corresponding to the host is given by the source address (00:13:02:d1:b6:4f)
1.4.3.7c
The MAC address corresponding to the access point is given by the BSSID: (00:16:b6:f7:1d:51)
Wireshark Lab #1
802.11
1.4.3.7d
The MAC address corresponding to the first -hop router is given by the destination address
(00:16:b6:f4:eb:a8)
1.4.3.7e
IP address of wireless host is as follows: 192.168.1.109.
1.4.3.7f
Destination IP address is as follows: 128.199.245.12
1.4.3.7g
The destination address corresponds to that of the server gaia.cs.umass.edu. This corresponds
to the first-hop router (00:16:b6:f4:eb:a8).
1.4.3.8
The 802.11 frame with the SYNACK segment for this session was received at 24.827751 seconds
into the trace. It is highlighted in blue in the screenshot below.
1.4.3.8a
The three MAC address fields are as follows:
BSSid: 00:16:b6:f7:1d:51
Destination address: 91:2a:b0:49:b6:4f
Source address: 00:16:b6:f4:eb:a8
Wireshark Lab #1
802.11
Figure 11: MAC address fields for the SYN ACK 802.11 frame
1.4.3.8b
The MAC address corresponding to the host is given by the destination address:
91:2a:b0:49:b6:4f
1.4.3.8c
The MAC address corresponding to the access point is given by the BSS id: 00:16:b6:f7:1d:51
1.4.3.8d
The MAC address corresponding to the first-hop router is given by the source address:
00:16:b6:f4:eb:a8
1.4.3.8e
No, the sender MAC address for this SYNACK frame is different to that of the SYN frame
previously explored. The sender address of the frame is 128.119.245.12 (which was the
destination address previously). The destination address is given by 192.168.1.109 (which was
the source address previously)
Wireshark Lab #1
802.11
1.4.4 Association/Disassociation
1.4.4.9
The two frames sent by the host to end the association with 30 Munroe St. are
1. The DHCP release frame sent to the DHCP serve with address 192.168.1.1 (sent at
49.583615 s)
1.4.4.10
A disassociation request was expected to be seen.
1.4.4.11
The host sends three authentication frames to the AP links_ses_24806, starting from
49.638857. The remaining requests are shown in the screenshot below.
1.4.4.12
The host wants that open access be given by the AP linkys_ses_24806.
Wireshark Lab #1
802.11
1.4.4.13
The host receives acknowledgement frames from linksys_ses_24806, but is not given
authentication at any point in time. No authentication frame is sent from linksys_ses_24806 to
the host.
1.4.4.14
The host sends an authentication frame to the AP 30 Munroe St. at 63.168087 seconds. An
authentication reply is sent from the AP back to the host at 63.169071 seconds.
1.4.4.15
The associate request from the host to the AP 30 Munroe St. is sent at 63.169910. The
corresponding associate reply is sent from the AP back to the host at 63.192101. Both of the
aforementioned frames are shown in the screenshot below.
1.4.4.16
The transmission rates are as follows:
1, 2, 5.5, 11, 6, 9, 12, 18, 24, 32, 48 Mb/second.
This set of rates is supported by both the host and the AP.
Wireshark Lab #1
802.11
1.4.5.17b
Wireshark Lab #1
802.11
Probe request frames are used in scanning an area to discover available networks. In the probe
request frame, there are two particularly important pieces of information (SSID and supported
rates). The AP receiving these probe requests then decides whether the host sending the probe
request can join its network. The rates supported by the host should be compatible with the
rates supported by the AP it wishes to connect to. The AP then sends a probe response frame
back to the host if both host and AP are compatible. If a probe response is received, the host
can then continue the process by sending an authentication request.
10
Wireshark Lab #1
802.11
References
Part 11: Wireless LAN Medium Access Control (MAC) And Physical Layer (PHY) Specifications.
1999. Ebook. 1st ed. http://gaia.cs.umass.edu/wireshark-labs/802.11-1999.pdf.
11