Repository navigation
4Wireshark_Analysis
Wireshark Analysis
- Overview
Wireshark is a network protocol analyzer used to inspect captured packets and examine network communication. In wireless security testing, packet analysis can help explain authentication traffic, management frames, and other observable wireless activity.
- Objective
The objective was to examine relevant packet-capture evidence from the authorized wireless lab and understand what the captured traffic demonstrated about the network's behavior.
- Capture Information
Test access point: Amos_Net
Captured filename: AmosNet-01.cap
Capture source: airodump-ng
Analysis tool: Wireshark
- Packet Inspection
The captured traffic was examined to identify relevant wireless frames and authentication-related activity.
The traffic captured included the following information:
- Beacon frames advertising the access point.
- Probe requests and probe responses.
- Authentication and association exchanges.
- De-authentication and disassociation frames, if present.
- WPA2 authentication-related traffic, where applicable.
- Authentication Traffic Analysis
Authentication-related packets were examined to understand which stages of the connection process were visible.
Observation:
- Management-Frame Analysis
The captured wireless packet was to examined and understand access-point announcements, connection management, andobserved disconnection events.
Observation: 7. Limitations
The analysis depends on the capture duration, channel, adapter capabilities, and traffic observed. An incomplete capture may not contain the full authentication exchange and encrypted packet remain secured. 8. Conclusion
Tool like airodump-ng and other used in network sniffing can be mitigated by updating the firmware of the access point and use the latest security protocol such as WPA3 Enterprise.