Airpcap Alternative
Amatista Sheeley
I'm trying to use dumpcap to capture 802.11 traces on a Windows machine (using an AirPcap Nx). I need to set the wifi channel, but I haven't been able to get the -k option to work. Should this work? If so, what is the syntax? If not, is there another alternative?
According to the dumpcap code the wifi channel setting is done through libnl which is only available for Linux, so it won't work on Windows and I don't think that libnl supports AriPcap on Linux (if you tried that as well). So, the dumpcap option -k does nothing on a Windows system.
Hint: If a supplied answer resolves your question can you please "accept" it by clicking the checkmark icon next to it. This highlights good answers for the benefit of subsequent users with the same or similar questions. For extra points you can up vote the answer (thumb up).
Please file a bug report against dumpcap -k. If an option doesn't work, then it should either be made to work as expected, or it should be removed from being listed and accepted on platforms where it doesn't work.
Yes, currently -k is Linux-only. Sadly, there do not yet exist libpcap APIs to allow the 802.11 channel to be set in a platform-independent fashion, so Wireshark needs to have its own platform-dependent code to do that, and that code has only been written for Linux so far.
Studying for CWAP, I embarked on a mission to capture 802.11 management frames using my Windows laptop. For those with MacBooks that do this natively, read no further, just keep on perfecting that smug look of disdain with a slight hint of pity for the rest of us Microsoft peasants.
While researching alternatives to pricey AirPcap adapters, I came across this Acrylic WiFi Professional post on their option for an NDIS driver. This driver allows you to capture in promiscuous mode, so you can capture all that management frame goodness, but without the AirPcap adapter. I checked out the supported USB wireless options, ordered one off the list from Amazon (I picked the NETGEAR A6200), and downloaded a free trial of Acrylic WiFi Pro to get started.
The installation of Acrylic Pro is straightforward, as is turning on Monitor Mode when you know where to look. By default, Monitor Mode is turned off and the NDIS driver is not installed. Just click the menu in the right corner, and select Change to get to the Monitor Mode settings.
Once the driver is installed you can swap over to the Packet Viewer using the icon in the top tool bar or by clicking Packet Viewer from the menu. You will also see that you are in Monitor Mode and can select to change out of Monitor Mode if so desired.
Unfortunately, I still had one tiny problem at this point. Every time I launched the Wireshark application, my built-in wireless card immediately quit passing all traffic. Not exactly ideal for productivity.
I would be remiss not to point out that there are limitations to this NDIS driver. For instance, there is no support for 40 or 80 MHz channels at this time. But for my CWAP study purposes, this is working quite well and saves me a bit of cash. Also, Ben Miller did a great write up on this very same subject, which, of course, I found just AFTER I went through this process and drafted this post. The universe has quite the sense of humor like that.
Specifically, this example deals with an XMedius fax server, a Cisco voice gateway with PRI, and a who-knows-what fax endpoint on the other side. Your mileage in fax troubleshooting may and likely will vary, just keep that in mind and a drink at hand.
I opened the packet capture for one of the failed attempts, navigated to Telephony -> VoIP Calls -> and then selected Flow for my call. When you do this, there will be quite a bit of information presented in graph form.
After working with TAC and doing a PCM capture on the gateway, I was able to confirm that the remote endpoint never sends the CFR, which meant I could declare with some amount of relative certainty that this was a whole lot of not-my-problem.***
TAC even provided me this handy-dandy flow graph built from the captures we took on the gateway, you can see that the fax server tries three times (TCF (9600)) to get the remote end to cough up a CFR, but no dice.
Anyone reading my blog posts or tweets knows that I am huge fan of Wireshark and all its packet capturing greatness, so let me point you to this great Big Tap video from Networking Field Day 8 where Sunit Chauhan demonstrates how you can troubleshoot a client issue using Big Tap Monitoring Fabric, even generating an impromptu packet capture in the process. The ease of the process is beautiful, just beautiful.
Disclaimer: While Networking Field Day, which is sponsored by the companies that present, was very generous to invite me to this fantastic event and I am very grateful for it, my opinions are totally my own, as all redheads are far too stubborn to have it any other way.
I've initially attempted to capture packets through ethernet. However, I believe the reason I'm not capturing any packets on that interface is that my router has a switch topology meaning it won't send any packets to the port my ethernet cable is connected to unless it's designated for my computer or it's a broadcast message. And turning on promiscuous mode doesn't change the result here.
I've since changed my focus to capturing wireless packets because it appears a wireless access point doesn't have the same restrictive filtering as my switch. What I mean is that wifi sends out the packets in a wide range. I believe it shouldn't be that hard to have my wireless adapter simply capture the traffic even if it doesn't have its IP address.
This has led me to many forums telling me to enable monitor mode on my adapter. I've watched from TheNewBoston's Wireshark tutorial that told me some adapters just don't have an option to turn on promiscuous mode (or in this case, I think he means monitor mode). Up until 4:30, he's explaining one that he uses that has worked for him in the past. So I went ahead and ordered the same one to make sure it can enable monitor mode. Now the trouble I'm running into is not entirely knowing if I've enabled it or not on the adapter. I have Npcap installed rather than WinpCap. Is having Npcap working with Wireshark enough? Do I have to do some manual procedure? And yes I've read the Wireshark wiki. On this subject, they say it's very operating system and adapter specific. Any help or easy setup's to get me capturing traffic is appreciated as well.
I've been attempting to enable promiscuous mode on an adapter TheNewBoston recommended and stated has the ability to do so. So now I'm curious what the procedure is to enable it for this adapater? Is having NPcap and Wireshark good enough? Any help is appreciated.
"AirPcapThe AirPcap adapters from Riverbed Technology allow full raw 802.11 captures under Windows, including radiotap information. Note that the AirPcap adaptors are no longer being sold by Riverbed, as announced in their End-of-Availability (EOA) Notice on October 2, 2017.
With Acrylic WiFi we have developed an NDIS driver that allows capturing WiFi traffic on Windows natively with most WiFi cards of the market and we have developed on it a new library that replaces the original Airpcap.dll library. This new library keeps the compatibility with Airpcap cards and gives a list of additional network interfaces with the alternative USB WiFi cards.
This allows you to use any USB WiFi card and to use WiFi cards as an alternative to Airpcap and capture WiFi packets on Windows and to exploit the use of 802.11ac cards to capture traffic on tools like Wireshark under Windows.
Riverbed AirPcap was formerly referred to as AirPcap. Visit Riverbed AirPcap overview page to learn more. Riverbed AirPcap USB-based adapters capture 802.11 wireless traffic for analysis by SteelCentral Packet Analyzer (Cascade Pilot) or Wireshark.
At the above link you can find one of the rare adapters that can be configured in monitor mode under Windows.You have to uninstall WinPcap and install Npcap, and the use WlanHelper to switch to monitor mode: when you launch Wireshark you will magically find a square to flag near the wireless interface, say "monitor mode".The only big problem is that the RadioTap header will not show the channel, and (in my knowledge) there is no possibility to choose the channel to monitor. With the same adapter I have used Acrylic Wi-Fi monitor (trial, then payd) and it seems to be most effective letting you to choose a specific band/channel or even offering a channel-hopping mode.
I'll mark this as the answer because it answers my original question. I ordered the linked adapter and was able to capture all traffic using WireShark. Although like you mentioned the information is partial. So I decided, like you, to buy a paid Acrylic Wi-Fi Professional license to capture packets on different channels.
However, under Wifi packet analyzer, it only shows beacons/broadcast messages. I've read here under 'Monitor Mode with NDIS driver'. But I don't know how to locate the NDIS driver or how to activate it.
Ignore my last comment. I was able to find the monitor mode option by clicking the hamburger menu item on the top right -> Change right underneath -> and turn on the monitor mode switch. This prompts a button fro the NDIS driver installation. It also lets you know the potential problems. Thanks to your recommendation It worked perfectly. I would upvote your answer and comments if I had enough reputation haha!