wireshark

How Multiple BSSID Helps in Wi-Fi 6

August 28, 2022 By Rowell Leave a Comment

Network operators will find an improvement with Wi-Fi 6/6E in how access points broadcast SSIDs. We won’t be getting away from environments that have several broadcasted SSIDs (ahem.. WeWork).

An environment surrounded by many Wi-Fi networks will be affected by beacon overhead. It will eat away at airtime due to the amount of SSIDs broadcasted. Multiple BSSID is mandatory in Wi-Fi 6. This will minimize the beacon overhead.

Table Of Contents

What is Multiple BSSID
Where can you find Multiple BSSID
How to capture Multiple BSSID
Resources

What is Multiple BSSID

Multiple BSSID is the advertisement of colocated SSIDs in a single beacon or probe response frame. The multiple SSIDs will correspond to a single SSID.

Prior to Wi-Fi 6/6E, multiple SSIDs from an access point would be broadcasted by its own individual BSSID. We’ve been told to keep broadcasted SSIDs to a maximum of three due to beacon overhead.

Airtime from multiple BSSIDs will contribute to airtime utilization resulting in wasted capacity and low efficiency.

I love how we bring existing methods into newer protocols many years later. Multiple BSSID was first defined in 802.11v-2011. 10 years later we’re now making it mandatory to use.

Where can you find Multiple BSSID

You’ll find the Multiple BSSID information from within the beacon and probe response frame. I’ve included a Wireshark capture from my test AP where I’ve configured 4 different SSIDs – Test-Net, Frame Thrower, Slurp Fish, and Banter.

There are two types of Multiple BSSIDs:

Transmitted
Non-Transmitted

In my capture, you’ll see one SSID in the beacon frame: Test-Net. That SSID is the Transmitted BSSID. The remaining SSIDs configured on the AP are Non-Transmitted BSSID.

Capturing Wi-Fi 6/6E

I use the EtherScope nXG to capture my Wi-Fi 6/6E frames. You can also do this with the AirCheck G3.

Within the frame capture, you’ll find another element – Multiple BSSID. This element contains the info we need to identify all the SSIDs being broadcasted. Inside of the subelement are the non-transmitted BSSIDs and their information.

The Multiple BSSID element contains useful information:

Max BSSID Indicator – Carries number of active BSSIDs in the multiple BSSID set

Nontransmitted BSSID Profile – One for each of the non-transmitted BSSIDs containing their information

Within the Nontransmitted BSSID Profile you’ll find all the capabilities for the additional SSIDs. Devices need to know what’s required to join these SSIDs.

How to capture Multiple BSSID

You can find these details in a few ways. You can do a frame capture and open the pcap inside of Wireshark just as I’ve shown above. You’ll need a Wi-Fi 6 capable device.

Using WiFi Explorer you can find these exact same details without needing to do a frame capture. You’ll need a Wi-Fi 6 capable device or capture file to import. Import my frame capture (linked below) into WiFi Explorer.

I’ve also used the EtherScope nXG to visualize Multiple BSSID. They indicate Transmitted and Non-Transmitted BSSID with specific icons and provide the capability to drill in further as shown in the screenshots below.

Transmitted Multiple BSSID from EtherScope nXG

Resources

Multiple BSSID Frame Capture

Wireshark Name Resolution

October 29, 2020 By Rowell Leave a Comment

We all want to work as efficiently as possible. After spending too much time staring at Wireshark pcap files and straining my eyes over frame exchanges, I got tired of looking for that MAC address I can never remember.

In Wireshark, this is called Ethernet Name Resolution.

Wireshark allows you to create custom name resolution. Instead of looking for a MAC address such as 7e:18:3c:1d:bb:51, I can have it stick out and say ROWELL_IPHONEXR.

I’m on MacOS. The easy way is to open terminal and navigate to where the Wireshark personalization files are which is:

~/.config/wireshark

You may or may not have a file named ethers. If not, create one and we can add our MAC layer name resolution:

vi ethers

Next, you can add each MAC address and the name you want it to resolve to such as:

7e:18:3c:1d:bb:51 ROWELL_IPHONEXR
5c:5b:35:54:7c:35 AP_MIST_HOME

Enter each resolution on its own line starting with the MAC address. Enter a single space and type in the name you desire. The name cannot contain a space character.

Save the file:

:wq

Next, restart Wireshark and check out the difference.

Identifying OWE Transition Mode with Wireshark

August 8, 2019 By Rowell 2 Comments

Share on twitter
Share on Twitter
Share on linkedin
Share on LinkedIn
Share on facebook
Share on FB
Share on email
Email

Opportunistic Wireless Encryption (OWE) will hopefully start entering the market to help secure open wireless networks. We’re getting a glimpse of it through Aruba Networks and Cisco.

With the C9800-CL and C9115 AP, I was able to get basic configuration done to enable OWE Transition Mode.

OWE Transition Mode is meant to provide a sort of backwards compatibility. A transition to OWE networks.

The way OWE Transition Mode works is by utilizing two SSIDs. One is an open SSID. No security parameters at all. The second SSID is hidden, has Protected Management Frames (PMF) required and has OWE enabled under WPA parameters.

Why do you need two SSIDs for OWE Transition Mode? Because there will be devices that do not support OWE yet. In this case, the non-OWE compatible device associates with the open SSID. If an OWE-compatible device associates to the open SSID, it will be told to associate to the OWE hidden SSID.

How do we spot this within the frames?

With a frame capture, we’re looking for Beacon frames to indicate if the WLAN supports OWE.

You can use a filter to find all Beacon frames:

wlan.fc.type_subtype == 8

A WLAN support OWE Transition Mode will simply be an open SSID containing no RSN Information Element. What you should be able to find is a Wi-Fi Alliance: OWE Transition Mode Information Element.

There are a few details to go over here. For one, you see that it is a vendor specific tag that says OWE Transition Mode.

More importantly, there is a BSSID and SSID listed. If you look near the top of the image above, we’re looking at a Beacon frame for SSID McFurly-OWETM.

Within the OWE Transition Mode information element, the actual OWE SSID is identified. In this case it is McFurly-OWE. That is the hidden ssid. That piece is how we transition an OWE-compatible device to the OWE only SSID.

The Beacon of OWE

Next, we look within the Beacon frame of the hidden SSID. To secure this open SSID it will be configured with WPA parameters using AES and Opportunistic Wireless Encryption (OWE). It will also contain the OWE information element as well.

The image above is the Beacon of the hidden SSID supporting OWE. Notice the SSID parameter is.. hidden. We’ll get into how we know this is the Beacon frame we’re looking for.

We see there is an RSN information element with an AES cipher and an AKM of Opportunistic Wireless Encryption (OWE). Well, there you go. That’s clearly the SSID we’re looking for.

Looking further below, there is an OWE Transition Mode information element. The difference with this entry is the BSSID and SSID. It is referencing the open SSID.

And again, an OWE compatible device will be told to associate to this hidden SSID, named McFurly-OWE. A non-OWE compatible device will simply associate to the open SSID, McFurly-OWETM.

YOUR TURN
What do you think about using Opportunistic Wireless Encryption to protect open SSIDs?

Identifying 802.11ax Support with Wireshark

August 2, 2019 By Rowell 3 Comments

We’re beginning to see vendors come out with their latest and greatest access points touting 802.11ax (Wi-Fi 6) support.

At the Cisco JustTheTech event, I was given a Cisco C9115 to try out for the purposes of testing Wi-Fi 6. At the time, the controller code didn’t have these features enabled.

How can a vendor come out with a Wi-Fi 6 AP but not have those features ready to go? The hardware is capable but in software, it had to be turned on.

In this blog post, we’ll look at how to identify 802.11ax support using Wireshark.

Do you find this content useful? If so, consider buying me a coffee! ☕

802.11ax – High Efficiency

At the time of this blog post, 802.11ax is still in draft form and the Wi-Fi Alliance had branded it as Wi-Fi 6. The developers at Wireshark added support to view the information elements and fields for 802.11ax.

You do not need an 802.11ax capable device to view some of these information elements. Using a frame capture tool such as Airtool or the Ekahau Sidekick, we can collect this information and view it within Wireshark.

I’m using Wireshark version 2.9.0.

If you’re interested in learning more about 802.11ax, please check out my podcast series with François Vergès.

Cisco C9800-CL 802.11ax Configuration

It’s important to note in the configuration, 802.11ax must be enabled. Using the C9800-CL, the option is enabled under High Throughput and under the WLAN configuration.

Configuration -> Radio Configurations -> High Throughput

Additionally, 802.11ax features must be enabled on the WLAN.

802.11ax features on the WLAN configuration

A Beacon of 802.11ax

The most notable place to see 802.11ax support is in the Beacon frame. After viewing the HT and VHT information elements will be an 802.11ax High Efficiency (HE) information element which holds many more details about the support of 802.11ax.

You’ll notice HE Capabilities and HE Operation below in the screenshot.

802.11ax High Efficiency Information Elements

Expanding the HE Capabilities information element, we can see all the details supported on the Cisco C9115. There’s a lot to unpack here and in the following screenshots but I will not dive into those details here.

The HE Operation information element contains more fields, including BSS Color.

What about spatial stream support? You can verify that within the Beacon frame as well by looking at the Supported HE-MCS and NSS Set field.

What’s In the Association Response

I noticed there were more details under the Association Response from the AP. In the Beacon we did not see TWT supported. But in the Association Response we are able to see TWT Requester Support as Supported.

802.11ax Association Response Frame – HE Capabilities

Should You Buy 802.11ax Today?

No. It’s too early to say how 802.11ax will perform with new hardware. There aren’t many 802.11ax capable clients. In my lab I used a Samsung S10 and an Lenovo with an Intel AX200. A lot more real world testing needs to be done to validate the operation of 802.11ax in today’s mixed environments.