Decoding and detailed analysis of captured frames in an IEEE 802.11 wireless LAN

• US 6,674,738 B1
• Filed: 09/17/2001
• Issued: 01/06/2004
• Est. Priority Date: 09/17/2001
• Status: Expired due to Fees

• Current Assignee: McAfee, Inc. (McAfee, LLC)
• Original Assignee: Networks Associates Technology, Inc. (McAfee, LLC)
• Inventors: Chen, Bing, Yildiz, Kazim Orhan
• Primary Examiner(s): Nguyen, Steven H. D
• Assistant Examiner(s): DUONG, DUC T
• Application Number:
  US09/954,389
• Time in Patent Office: 841 Days
• Field of Search: 370/338, 370/252, 370/401, 370/242, 370/245, 370/465, 370/474
• US Class Current: 370/338
• CPC Class Codes: H04L 1/0045 Arrangements at the receiver end
• CPC Class Codes: H04L 1/1685 the supervisory signal being transmitted in response to a specific request, e.g. to a polling signal
• CPC Class Codes: H04L 49/9073 Early interruption upon arrival of a fraction of a packet
• CPC Class Codes: H04L 49/9094 Arrangements for simultaneous transmit and receive, e.g. simultaneous reading/writing from/to the storage element
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 28/06 Optimizing the usage of the radio link, e.g. header compression, information sizing , discarding information system modifying transmission characteristic according to link quality by modifying frame length H04L1/0007; dynamic adaptation of the packet size for flow control or congestion control H04L47/365
• CPC Class Codes: H04W 28/14 using intermediate storage
• CPC Class Codes: H04W 28/18 Negotiating wireless communication parameters
• CPC Class Codes: H04W 76/10 Connection setup
• CPC Class Codes: H04W 8/26 Network addressing or numbering for mobility support
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

A method and apparatus for detecting and diagnosing wireless network failures, provides for capturing, analyzing, and displaying detailed information relative to data packets and/or frames transmitted across a wireless network including an IEEE 802.11 LAN.

Claims

1. A method for decoding information contained in an IEEE 802.11 header of data packets or frames transmitted between stations in a wireless Local Area Network (LAN), said method comprising:

establishing a direct wireless logical connection with the wireless communications network;

receiving wirelessly, in real-time, data packets or frames transmitted in the wireless communication network;

storing in a memory storage device, the data packets or frames captured; and

decoding and displaying the information contained in the respective IEEE 802.11 headers of the data packets or frames;

wherein said decoding and displaying includes;

displaying a menu to a user to permit the user to select a captured file containing frames or data packets; and

analyzing in detail each bit of the IEEE 802.11 header of each frame of the captured file in the order they are stored in a capture buffer memory;

wherein said analyzing further includes;

determining parameters necessary to decode the associated IEEE 802.11 header of a current frame being analyzed;

determining if the current frame is a portion of a larger fragmented frame;

reassembling the current frame if it is determined it is a portion of a larger fragmented frame;

determining the source and destination addresses of the current frame;

displaying the source and destination addresses of the current frame;

executing a summary routine for determining short concise summary information relative to the current frame;

displaying said summary information about the contents of the current frame;

decoding individually for each layer the information contained in the current frame; and

displaying the decoded information.

2. The method of claim 1, wherein said decoding step further includes the steps of:

determining the parameters required to decode the information in the current frame;

determining the frame type and subtype of the current frame;

storing in memory the frame type and subtype of the current frame; and

displaying the frame type and subtype.

3. The method of claim 2, wherein said step of determining the frame type and subtype of the current frame, further includes the steps of:

determining if the current frame is a “

Management frame”

;

determining, if not a management frame, if the current frame is a “

Control”

frame;

determining, if not a Control frame, if the current frame subtype is either an “

Acknowledgment (ACK)”

or “

Clear to Send (CTS)”

frame;

determining, if not an ACK or CTS frame, if the current frame is a “

Data”

frame;

determining, when the frame is a “

Data”

frame, if both ToDS and FromDS fields are set to one; and

setting the value of a variable “

ulHeader Length”

to a value indicative of the determined frame type and subtype of the current frame.

4. The method of claim 1, wherein said steps of reassembling the current frame, further includes for determining the parameters required to reassemble a fragmented frame, the steps of:

determining whether the current frame is one of a “

Control”

frame or a frame with an error, or an encrypted frame, and if “

Yes”

, disable its reassembly;

determining, if “

No”

in the previous step, if the current frame is originally decrypted, and if so increase its length by 4 octets, but if not, set a data offset to the length of a MAC header, and the current frame'"'"'s length to u ulFragmentLength;

determining if “

More Flag”

field of the current frame is set to one, said step further including if”

Yes”

determining if the fragment of the current frame is zero, and if “

Yes,”

set the fragment type to “

First Fragment”

, set a data effort to zero, and enable reassembly, whereas if the fragment is not zero, set the fragment type to “

Middle Fragment”

, reduce the fragment length of the current frame by the data offset, and enable reassembly;

detennining, in response to the “

More Flag”

being set to zero, if the fragment number is zero, said step further including if “

Yes”

disabling reassembly of the current frame, whereas if “

No,”

set the fragment type to “

Last Fragment,”

reduce the fragment length by the data offset, and enable reassembly; and

determining if the current frame is a decrypted frame, if “

Yes,”

increase the fragment length by 4 octets.

5. The method of claim 1, wherein said step of determining the source and destination addresses of the current frame includes the steps of:

determining if the current frame type is a “

Control”

frame;

determining, if “

Yes”

in the immediately previous step, if the current frame subtype is either an “

Acknowledgment (ACK)”

or “

Clear To Send (CTS)”

frame, and if “

Yes”

set a variable “

DestAddr”

to the contents of an “

Address 1”

field, followed by determining if a transmitter address is known, if so, set the contents of an “

Implied Transmitter Address”

variable to the address of a transmitting station;

determining, in response to the current frame type not being a “

Control”

frame, if the frame type is a “

Management”

frame, and if “

Yes,”

set “

DestAddr” and

“

SrcAddr”

variables to the contents of “

Address 1” and

“

Address2”

fields, respectively;

determining, in response to the current frame type not being a “

Management”

frame, whether the current frame type is a “

Data”

frame; and

determining, in response to the current frame being a “

Data”

frame, if a “

ToDS”

bit field is set to zero, and if “

Yes,”

set a “

DestAddr”

variable to the contents of an “

Address 1”

field, followed by the steps of determining if a “

FromDS”

bit field is set to zero, and if “

Yes”

, set a variable “

SrcAddr”

to the contents of an “

Address2”

field, whereas if “

No”

, set the variable “

SrcAddr”

to the contents of an “

Address3”

, whereas if the “

ToDS;

bit field is not set to zero, set the variable “

DestAddr”

to the contents of the “

Address3”

field 36, followed by determining if “

FromDS”

bit field is now set to zero, and if “

Yes”

, set the variable “

SrcAddr”

to the contents of the “

Address2”

field, whereas if the “

FromDS”

bit field is not set to zero, set the variable “

SrcAddr”

to the contents of an “

Address4”

field.

6. The method of claim 2, wherein said summary routine includes the steps of:

initializing a string to be used in a summary line for display;

formatting a data rate and signal strength level provided by a Network QuInterface Card (NIC);

using a bit value indicative of the subtype of the current frame, as obtained from said step for determining the subtype, to format the name of the frame subtype from a table established to correlate bit values to frame subtype-names, respectively;

determining if a wired equivalent privacy (WEP) bit field is set to one, and if “

Yes,”

add a WEP string to said summary line; and

determining if a “

Retry”

bit field is set to one, and if “

Yes,”

add a “

Retry”

string to said summary line.

7. The method of claim 2, wherein said step of decoding further includes the step of:

determining if the frame type is a “

Management Frame”

;

executing a FormatManagementDetail( ) subroutine in response to determining a “

Management”

frame;

determining if the frame type is a “

Control”

frame, in response to it not being a “

Management”

frame;

executing a FormatControlDetail( ) subroutine, in response to the frame being a “

Control”

frame;

determining, in response to the frame not being a “

Control”

frame, if it is a “

Data”

frame; and

executing a FormatControlDetail( ) subroutine in response to the frame being a “

Data”

frame.

8. The method of claim 7, wherein said FormatManagementDetail( ) subroutine includes the steps of:

determining via a Network Interface Card (NIC) physical layer related information;

executing a DisplayPhysicalLayerInformation( ) routine to display said physical layer related information;

executing a DisplayFrameControlField( ) routine;

displaying the contents of a duration field as a little-endian unsigned integer of two octets in lengths;

executing a DisplayDestinationAddress( ) routine to display a destination address;

executing a DisplaySourceAddress( ) routine to display a source address;

executing a DisplayBSSID( ) routine to display Basic Service Set Identification information;

executing a DisplaySequenceControlField( ) routine to display fragment and sequence numbers for the current frame; and

executing a FormatManagementFrameSubtype( ) to a decode and display information contained in a frame body section specific to management frame subtypes.

9. The method of claim 8, wherein said FormatManagementFrameSubtype( ) includes the steps of:

determining if the frame subtype is an “

Association Request”

frame;

executing, in response to the frame being an “

Association Request, a DisplayAssociationRequestFrameDetail( ) for displaying the frame details;

determining, in response to “

No”

for the immediately precoding determining step, if the frame subtype is a Reassociation Request”

frame;

if “

Yes”

, execute a DisplayReassociationRequestFrameDetail( ) routine;

if “

No”

, determine if the frame subtype is either an “

Association Response”

or “

Reassociation Response”

frame;

if “

Yes”

, execute a DisplayReassociationResponseFrameDetail( );

if “

No”

, determine if the frame subtype is a “

Probe Request”

frame;

if “

Yes”

, execute a DiplayProbeRequestFrameDetail( ) routine;

if “

No”

, determine if the frame subtype is a “

Probe Response”

frame;

if “

Yes”

, execute a DisplayProbeResponseFrameDetail( ) routine;

if the frame subtype is not a “

Probe Response,”

determine if the frame subtype is a “

Beacon”

frame;

if “

Yes”

, execute a DisplayBeaconFrameDetail( ) routine;

if “

No”

, determine if the frame subtype is a “

Disassociation”

frame;

if “

Yes”

, execute a DisplayDisassociationFrameDetail( ) routine;

if “

No”

, determine if the frame subtype is an “

Authentication”

frame;

if “

Yes”

, execute a DisplayAuthenticationFrameDetail( ) routine;

if “

No”

, determine if the frame type is a “

Deauthentication”

frame; and

if “

Yes”

, execute a DisplayDeauthenticationFrameDetail( ) routine.

10. The method of claim 9, wherein said DisplayAssociationRequestFrameDetail( ) routine includes the steps of:

display the contents of a “

Listen Interval”

field 4408, to indicate to a current Access Point how often a station wakes to listen to Beacon management frames;

display a MAC address of the current Access Point;

display a current AP address field 4508 by executing a DisplaySourceAddress( ) routine;

execute a DisplaySSIDInformationElement( ) routine;

execute a DisplaySupportedRatesInformationElemnent( ) routine;

determine if there is an unknown information element at the end of the frame; and

if “

Yes”

, execute a DisplayUnknownInformationElement( ) routine.

11. The method of claim 9, wherein said DisplayRe_associationResponseFrameDetail( ) routine includes the steps of:

execute a DisplayCapabilityInformationElement( ) routine;

display the contents of a “

Status Code”

field 4506 obtained from a table of code values;

display the contents of an “

Association ID”

field 4504 as an unsigned integer;

set the two most significant bits of an association ID field 4504 to ones;

execute a DisplaySupportedRatesInformationelement( ) routine;

determine if there is an unknown information element at the end of the current frame; and

if “

Yes”

, execute a DisplayUnknownInformationElement( ) routine.

12. The method of claim 9, wherein said DisplayProbeRequestFrameDetail( ) routine includes the steps of:

execute a DisplaySSIDInformationElement( ) routine;

execute a DisplaySupportedRatesInformationElement( ) routine;

determine if there is an unknown information element at the end of the current frame; and

if “

Yes”

, execute a DisplayUnknownInformationElement( ) routine.

13. The method of claim 9, wherein said DisplayProbeResponseFrameDetail( ) routine includes the steps of:

display a “

Time stamp field 4602 as an unsigned little endian integer;

display a “

Beacon Interval”

field 4406 representing the number of time units between target beacon transmission times;

execute a DisplayCapabilityInformationElement( ) routine;

execute a DisplaySSIDInformationElement( ) routine;

execute a DisplaySupportedRatesInformationElement( ) routine;

execute a DisplayDSParameterSetInformationElement( ) routine;

determine if the frame contains a “

CF Parameter Set”

information element as transmitted by Access Points supporting a Point Coordination Function, and if so execute a DisplayCFParameterSetInformationElement( ) routine;

determine if a sending station is operating in an Independent Basic Service Set, and if so execute a DisplayIBSSParameterSetInformationElement( ) routine;

determine if there is an unknown information element at the end of the frame; and

if “

Yes”

, execute a DisplayUnknosvnInformationElement( ) routine.

14. The method of claim 9, wherein said DisplayBeaconFrameDetail( ) routine includes the steps:

display a “

Timestamp”

field 4602;

display a “

Beacon Interval”

field 4406 representing the number of time units between target beacon transmission times;

executing a DisplayCapabilityInformationelement( ) routine;

execute a DisplaySSIDInformationElement( ) routine;

execute a DisplaySupportedRatesInformationElement( ) routine;

execute a DisplayDSParameterSetInformationElement( ) routine;

determine if the frame contains a “

CF Parameter Set”

information element as transmitted by Access Points supporting a Point Coordination Function, and if so, execute a DisplayCFParameterSetInformationElement( ) routine;

determine if an associated sending station is operating in an Independent Basic Service Set, and if so, execute a DisplayIBSSParameterSetInformationElement( ) routine;

execute a DisplayTIMParameterSetInformationElement( ) routine;

determine if there is an unknown information element at the end of the frame, and if “

Yes”

, execute a DisplayUnknownInformationElement( ) routine.

15. The method of claim 9, wherein said DisplayDisassociationFrameDetail( ) includes the steps:

display the contents of a “

Reason Code”

field 4502;

display a message corresponding to a “

Reason Code”

field 4502; and

determine if there is an unknown information element at the end of the frame, and if “

Yes,”

execute a DisplayUnknownInformationElement( ).

16. The method of claim 9, wherein said DisplayAuthenticationFrameDetail( ) routine includes the steps of:

determine if a “

WEP”

bit field is set to one, and if “

Yes”

, the frame is originally encrypted;

display, if “

Yes,”

the contents of a WEP-IV field;

determine if the frame is decrypted, and if “

No,”

display the contents of the encrypted data;

display the contents of a WEP-ICV field that carries an “

Integrity Check Value”

of encrypted data;

if the frame is not originally encrypted or the frame is decrypted, display the contents of an “

Authentication Algorithm Number”

field that is an unsigned number for which allowed values are 0, which corresponds to Open System Authentication, and 1, which corresponds to Shared Key Authentication;

display the contents of an “

Authentication Transaction Sequence Number”

field that is an unsigned number used to identify the frame number used in an authentication exchange sequence;

display the contents of a “

Status Code”

field 4506;

determine whether the “

Authentication Algorithm Number”

is equal to 1 (Shared Key), and a transaction sequence number is either 2 or 3, and if “

Yes”

execute a DisplayChallengeTextInformationElement( ) routine;

determine if there is an unknown information element at the end of the frame, and if “

Yes”

, execute a DisplayUnknownInformationElement( ) routine; and

determine if the frame is a decrypted frame, and if “

Yes”

, display the contents of a WEP-ICV field.

17. The method of claim 9, wherein said DisplayAuthorizationFrameDetail( ) routine is for decoding and displaying information contained in a frame body field of a “

Deauthentication”

management frame subtype, includes the steps;

display the contents of a “

Reason Code”

field 4502 that is an unsigned number;

display a message corresponding to the “

Reason Code”

field 4502; and

determine if there is an unknown information element at the end of the frame, and if “

Yes,”

execute a DisplayUnknownInformationElement( ) routine.

18. The method of claim 7, wherein said FormatCTRLDetail( ) routine for decoding and displaying information contained in a “

Control”

frame type includes the steps;

execute a DisplayPhysicalLayerInformation( ) routine to display physical layer related information determined by a Network Interface Card (NIC);

execute a DisplayFrameControlField( ) routine;

determine if the frame subtype is a “

Power Save (PS)-Poll”

frame, and if “

Yes”

execute a FormatPS_POLLDetail( ) routine;

determine, if “

No”

in the immediately previous step, whether the frame subtype is a “

Request To Send”

(RTS) frame, execute a FormatRTSDetail( ), if “

Yes”

in the immediately previous step;

if the result of the immediately previous “

determine”

step is “

No”

, determine if the frame subtype is not RTS, whether the frame subtype is either a “

Clear To Send (CTS)”

or an “

Acknowledgment (ACK) frame, and if “

Yes”

, execute a FormatCTS_ACKDetail( ); and

if the frame subtype is not CTS or ACK, determine whether the frame subtype is either a “

Contention Free (CF)-End”

or a “

CF-End+CF-Ack”

frame, and if “

Yes”

, execute a FormatCF_END_ACKDetail( ) routine.

19. The method of claim 18, wherein said FormatPS_POLLDetail( ) routine for decoding and displaying information container in said Power Save (PS)-Poll frame, includes the steps:

determine if the two most significant bits of an “

Association ID”

field are not set to one, because the IEEE 802.11 standard requires these bits to be set to one, and if “

Yes”

, display a warning message “

2 MSB bits of Association ID field should be 1”

;

if “

No”

for the previous step, check if a little-endian number in the “

Association ID”

field is between 1 and 2007, and if “

Yes”

, display the contents of the “

Association ID field”

as an uasigned integer;

if the result of the immediately previous step is “

No”

, display a warning message “

Association ID should be in range 1 to 2007”

;

execute a DisplayBSS( ) routine; and

execute a DisplayTransmitterAddress( ) routine.

20. The method of claim 18, wherein said FormatRTSDetail( ) routine for decoding and displaying information contained in said RTS frame, includes the steps:

display the contents of a duration field as a little-endian unsigned integer;

execute a DisplayReceiverAddrcss( ) routine; and

execute a DisplayTransmitterAddress( ) routine.

21. The method of claim 18, wherein said FormatCTS_ACKDetail( ) routine for decoding and displaying information contained in said CTS and ACK frames, includes the steps:

display the contents of a duration field as a little-endian unsigned integer;

execute a DisplayReceiverAddress( ) routine;

determine if a transmitter address is known; and

if the transmitter address is known, execute a DisplayTransmitterAddress( ) routine.