rjmcmahon
/
fiwi_monitor
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Focus analysis on 802.11 headers only, ignore encrypted payloads 

- Remove IP/TCP/UDP field extraction (payloads are encrypted)
- Extract 802.11 frame control fields: protected, retry, duration
- Analyze QoS Data frames (type 2, subtype 8) which iperf uses
- Show encryption status and frame characteristics
- Update field numbers for radiotap.present (now field 11)

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Robert McMahon 2026-02-13 14:31:16 -08:00
parent ee168ad839
commit 43c096e5d2
1 changed files with 58 additions and 60 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

118
test_monitor_tshark.sh
View File

@ -194,8 +194,7 @@ else
fi fi
# Now parse the pcap file to extract fields # Now parse the pcap file to extract fields
# Don't use display filter - extract all frames and handle missing fields gracefully # Only extract 802.11 header fields - data payloads are encrypted
# Include IP addresses to identify iperf traffic
CAPTURE_OUTPUT=$(tshark -q -r "$TEMP_PCAP" -n -T fields \ CAPTURE_OUTPUT=$(tshark -q -r "$TEMP_PCAP" -n -T fields \
-e frame.number \ -e frame.number \
-e frame.time \ -e frame.time \
@ -204,14 +203,10 @@ CAPTURE_OUTPUT=$(tshark -q -r "$TEMP_PCAP" -n -T fields \
-e wlan.fc.type \ -e wlan.fc.type \
-e wlan.fc.subtype \ -e wlan.fc.subtype \
-e wlan.fc.type_subtype \ -e wlan.fc.type_subtype \
-e wlan.fc.protected \
-e wlan.fc.retry \
-e wlan.duration \
-e radiotap.present \ -e radiotap.present \
-e ip.src \
-e ip.dst \
-e ip.proto \
-e tcp.srcport \
-e tcp.dstport \
-e udp.srcport \
-e udp.dstport \
2>&1 | grep -v "^tshark:" | grep -v "^Running as" | grep -v "^Capturing" || true) 2>&1 | grep -v "^tshark:" | grep -v "^Running as" | grep -v "^Capturing" || true)
# Clean up temp file (unless KEEP_PCAP is set) # Clean up temp file (unless KEEP_PCAP is set)
@ -251,8 +246,8 @@ if [ "$FINAL_COUNT" -lt "$RAW_PACKET_COUNT" ] && [ "$RAW_PACKET_COUNT" -gt 10 ];
fi fi
# Count packets with PLCP headers (radiotap present) # Count packets with PLCP headers (radiotap present)
# radiotap.present field is the 8th field (after frame.number, frame.time, wlan.ra, wlan.ta, wlan.fc.type, wlan.fc.subtype, wlan.fc.type_subtype) # radiotap.present is field 11 (after frame.number, frame.time, wlan.ra, wlan.ta, wlan.fc.type, wlan.fc.subtype, wlan.fc.type_subtype, wlan.fc.protected, wlan.fc.retry, wlan.duration)
PLCP_COUNT=$(echo "$PACKET_LINES" | awk -F'\t' 'NF >= 8 && $1 != "" && $8 != "" && $8 != "0" && $8 != "-" {count++} END {print count+0}' || echo "0") PLCP_COUNT=$(echo "$PACKET_LINES" | awk -F'\t' 'NF >= 11 && $1 != "" && $11 != "" && $11 != "0" && $11 != "-" {count++} END {print count+0}' || echo "0")
# Display stats immediately - always show these # Display stats immediately - always show these
echo "Total packets captured: $FINAL_COUNT" echo "Total packets captured: $FINAL_COUNT"
@ -272,15 +267,13 @@ if [ -n "$PACKET_LINES" ] && [ "$FINAL_COUNT" -gt 0 ]; then
ta = ($4 != "" && $4 != "-") ? $4 : "N/A" ta = ($4 != "" && $4 != "-") ? $4 : "N/A"
type = ($5 != "" && $5 != "-") ? $5 : "N/A" type = ($5 != "" && $5 != "-") ? $5 : "N/A"
subtype = ($6 != "" && $6 != "-") ? $6 : "N/A" subtype = ($6 != "" && $6 != "-") ? $6 : "N/A"
radiotap = ($8 == "1" || $8 == "1.0") ? "yes" : (($8 != "" && $8 != "-") ? "no" : "N/A") protected = ($8 == "1" || $8 == "1.0") ? "encrypted" : "unencrypted"
src_ip = ($9 != "" && $9 != "-") ? $9 : "" retry = ($9 == "1" || $9 == "1.0") ? "retry" : ""
dst_ip = ($10 != "" && $10 != "-") ? $10 : "" duration = ($10 != "" && $10 != "-") ? $10 : "N/A"
ip_info = "" radiotap = ($11 == "1" || $11 == "1.0") ? "yes" : (($11 != "" && $11 != "-") ? "no" : "N/A")
if (src_ip != "" && dst_ip != "") { retry_str = (retry != "") ? sprintf(" [%s]", retry) : ""
ip_info = sprintf(" IP=%s->%s", src_ip, dst_ip) printf " Frame %s: RA=%s, TA=%s, type=%s/%s, %s, dur=%s, PLCP=%s%s\n",
} $1, ra, ta, type, subtype, protected, duration, radiotap, retry_str
printf " Frame %s: RA=%s, TA=%s, type=%s/%s, PLCP=%s%s\n",
$1, ra, ta, type, subtype, radiotap, ip_info
}' }'
echo "" echo ""
@ -327,48 +320,36 @@ if [ -n "$PACKET_LINES" ] && [ "$FINAL_COUNT" -gt 0 ]; then
}' | sort -rn }' | sort -rn
echo "" echo ""
# Look for IP traffic (iperf typically uses TCP port 5001) # Analyze data frames (iperf uses QoS Data frames, subtype 8)
echo "IP traffic analysis (looking for iperf on TCP port 5001):" echo "Data frame analysis (iperf typically uses QoS Data frames, subtype 8):"
IPERF_FRAMES=$(echo "$PACKET_LINES" | awk -F'\t' '{ DATA_FRAMES=$(echo "$PACKET_LINES" | awk -F'\t' '{
src_port = ($12 != "" && $12 != "-") ? $12 : "" type = ($5 != "" && $5 != "-") ? $5 : ""
dst_port = ($13 != "" && $13 != "-") ? $13 : "" subtype = ($6 != "" && $6 != "-") ? $6 : ""
proto = ($11 != "" && $11 != "-") ? $11 : "" if (type == "2" && subtype == "8") { # QoS Data frames
if ((src_port == "5001" || dst_port == "5001") && proto == "6") {
print $0 print $0
} }
}') }')
IPERF_COUNT=$(echo "$IPERF_FRAMES" | wc -l || echo "0") DATA_COUNT=$(echo "$DATA_FRAMES" | wc -l || echo "0")
if [ "$IPERF_COUNT" -gt 0 ]; then echo " QoS Data frames (type 2, subtype 8): $DATA_COUNT"
echo " Found $IPERF_COUNT frames with TCP port 5001 (iperf)"
echo " Sample iperf frames:" # Count encrypted vs unencrypted data frames
echo "$IPERF_FRAMES" | head -5 | awk -F'\t' '{ ENCRYPTED_DATA=$(echo "$DATA_FRAMES" | awk -F'\t' '$8 == "1" || $8 == "1.0" {count++} END {print count+0}')
UNENCRYPTED_DATA=$(echo "$DATA_FRAMES" | awk -F'\t' '$8 != "1" && $8 != "1.0" && $8 != "" && $8 != "-" {count++} END {print count+0}')
echo " Encrypted: $ENCRYPTED_DATA"
echo " Unencrypted: $UNENCRYPTED_DATA"
if [ "$DATA_COUNT" -gt 0 ]; then
echo " Sample QoS Data frames (likely iperf traffic):"
echo "$DATA_FRAMES" | head -5 | awk -F'\t' '{
ra = ($3 != "" && $3 != "-") ? $3 : "N/A" ra = ($3 != "" && $3 != "-") ? $3 : "N/A"
ta = ($4 != "" && $4 != "-") ? $4 : "N/A" ta = ($4 != "" && $4 != "-") ? $4 : "N/A"
src_ip = ($9 != "" && $9 != "-") ? $9 : "N/A" protected = ($8 == "1" || $8 == "1.0") ? "encrypted" : "unencrypted"
dst_ip = ($10 != "" && $10 != "-") ? $10 : "N/A" retry = ($9 == "1" || $9 == "1.0") ? "retry" : ""
src_port = ($12 != "" && $12 != "-") ? $12 : "N/A" duration = ($10 != "" && $10 != "-") ? $10 : "N/A"
dst_port = ($13 != "" && $13 != "-") ? $13 : "N/A" retry_str = (retry != "") ? sprintf(" [%s]", retry) : ""
printf " Frame %s: %s:%s -> %s:%s (RA=%s, TA=%s)\n", printf " Frame %s: RA=%s, TA=%s, %s, dur=%s%s\n",
$1, src_ip, src_port, dst_ip, dst_port, ra, ta $1, ra, ta, protected, duration, retry_str
}' }'
else
echo " No frames found with TCP port 5001"
echo " Checking for any TCP traffic:"
TCP_COUNT=$(echo "$PACKET_LINES" | awk -F'\t' '$11 == "6" {count++} END {print count+0}')
echo " TCP frames: $TCP_COUNT"
if [ "$TCP_COUNT" -gt 0 ]; then
echo " Sample TCP frames:"
echo "$PACKET_LINES" | awk -F'\t' '$11 == "6" {print}' | head -5 | awk -F'\t' '{
ra = ($3 != "" && $3 != "-") ? $3 : "N/A"
ta = ($4 != "" && $4 != "-") ? $4 : "N/A"
src_ip = ($9 != "" && $9 != "-") ? $9 : "N/A"
dst_ip = ($10 != "" && $10 != "-") ? $10 : "N/A"
src_port = ($12 != "" && $12 != "-") ? $12 : "N/A"
dst_port = ($13 != "" && $13 != "-") ? $13 : "N/A"
printf " Frame %s: %s:%s -> %s:%s (RA=%s, TA=%s)\n",
$1, src_ip, src_port, dst_ip, dst_port, ra, ta
}'
fi
fi fi
echo "" echo ""
@ -385,16 +366,33 @@ if [ -n "$PACKET_LINES" ] && [ "$FINAL_COUNT" -gt 0 ]; then
SERVER_COUNT=$(echo "$SERVER_FRAMES" | wc -l || echo "0") SERVER_COUNT=$(echo "$SERVER_FRAMES" | wc -l || echo "0")
echo " Total frames with server MAC: $SERVER_COUNT" echo " Total frames with server MAC: $SERVER_COUNT"
if [ "$SERVER_COUNT" -gt 0 ]; then if [ "$SERVER_COUNT" -gt 0 ]; then
echo " Frame type breakdown:"
echo "$SERVER_FRAMES" | awk -F'\t' '{
type = ($5 != "" && $5 != "-") ? $5 : "unknown"
subtype = ($6 != "" && $6 != "-") ? $6 : "unknown"
type_name = "Unknown"
if (type == "0") type_name = "Management"
else if (type == "1") type_name = "Control"
else if (type == "2") type_name = "Data"
count[type_name]++
}
END {
for (t in count) {
printf " %s: %d frame(s)\n", t, count[t]
}
}' | sort -rn
echo " Sample frames:" echo " Sample frames:"
echo "$SERVER_FRAMES" | head -5 | awk -F'\t' '{ echo "$SERVER_FRAMES" | head -5 | awk -F'\t' '{
ra = ($3 != "" && $3 != "-") ? $3 : "N/A" ra = ($3 != "" && $3 != "-") ? $3 : "N/A"
ta = ($4 != "" && $4 != "-") ? $4 : "N/A" ta = ($4 != "" && $4 != "-") ? $4 : "N/A"
type = ($5 != "" && $5 != "-") ? $5 : "N/A" type = ($5 != "" && $5 != "-") ? $5 : "N/A"
subtype = ($6 != "" && $6 != "-") ? $6 : "N/A" subtype = ($6 != "" && $6 != "-") ? $6 : "N/A"
src_ip = ($9 != "" && $9 != "-") ? $9 : "N/A" protected = ($8 == "1" || $8 == "1.0") ? "encrypted" : "unencrypted"
dst_ip = ($10 != "" && $10 != "-") ? $10 : "N/A" retry = ($9 == "1" || $9 == "1.0") ? "retry" : ""
printf " Frame %s: RA=%s, TA=%s, type=%s/%s, IP=%s->%s\n", duration = ($10 != "" && $10 != "-") ? $10 : "N/A"
$1, ra, ta, type, subtype, src_ip, dst_ip retry_str = (retry != "") ? sprintf(" [%s]", retry) : ""
printf " Frame %s: RA=%s, TA=%s, type=%s/%s, %s, dur=%s%s\n",
$1, ra, ta, type, subtype, protected, duration, retry_str
}' }'
fi fi
echo "" echo ""