Ask Your Question
0

Help interpreting the attached WLAN record(s)

asked 2025-02-16 14:20:16 +0000

Griswold gravatar image

updated 2025-02-16 17:23:49 +0000

Chuckc gravatar image

I'm having a problem with a particular device on my WLAN. Did a 'sniff' with the built in sniffer on my MAC and examined the output with WireShark.

The following is what WireShark shows. Apologies for using a link but apparently I don't have enough 'points' to upload a pic.

https://imgur.com/TR3onPS

Am I right in interpreting this? The device, a Ring Chime Pro, is sending something to itself as the Source Address and Destination Address are both the same MAC address?

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
1

answered 2025-02-16 17:46:12 +0000

Bob Jones gravatar image

sending something to itself as the Source Address and Destination Address are both the same MAC address

Unlikely. The radio would not put it in the air - just like when you ping your own IP address, it doesn't hit the wire. What we do see is this is a FromDS frame, so actually transmitted by the AP, not the wireless client / Ring device. What this could be is group traffic - multicast or broadcast, and then the AP (also know as the DS) is converting group traffic to unicast (often called multicast-to-unicast conversion, but usually works for broadcast, too, when enabled). So an interpretation is this Ring device sends a group frame to the AP (find the ToDS frame if you can that has a group destination), the AP gets it and then sends it back out over the air so wireless clients can see it, but unicasts it this time. So the source stays the same but the destination is translated to a unicast MAC, one frame for each wireless client.

With limited information provided in the picture, this only offers a possible explanation of what we see. Closer examination of the capture file can either rule this explanation in or out. Its very unlikely, but possible, you have other things going on like duplicate MAC addresses, you are doing traffic injection arbitrarily setting MAC addresses, and other unusual edge cases.

edit flag offensive delete link more

Comments

Thanks for that, appreciated. I can be quite certain that there are no duplicated MAC addresses on my WLAN on either the 2.4Ghz or 5Ghz segments. All the Ring devices, 8 including the Chime Pro, are on the 2.4Ghz segment.

Looking at the trace there are no other Ring devices communicating with either the Router or the Chime Pro whilst this is happening, though the Router responds with the occasional Block Ack to the Ring Pro following these bursts.

I've waded through the trace and I'm afraid I can't find a ToDS frame with a destination that would indicate Ring Devices anywhere in the duration of the trace, (8:38 - 9.00).

Other Ring devices do send information, but it's the usual RTS/CTS type scenario.

This is all tied to an issue where the Zyxel 3301-T0 is reporting that the Chime Pro is ...(more)

Griswold gravatar imageGriswold ( 2025-02-17 14:28:09 +0000 )edit

Some ideas: make sure your capture is complete - are you really capturing all the traffic from the wireless client to the AP? Might need a wired capture at the same time on the other side of the AP to see what is there. Decryption can help, too, since it will tell exactly what this traffic is.

A BlockAck to the wireless client from the DS/AP indicates unicast data is sent from the wireless client to the AP and if you don't see it in the capture, the capture is not complete for one of many possible reasons - capture envelope is not big enough here (not likely here since capture is on a MAC of an IOT device), you are too far away, etc.

Bob Jones gravatar imageBob Jones ( 2025-02-18 11:09:47 +0000 )edit

Replying for the updates.

AlfredBancroft gravatar imageAlfredBancroft ( 2025-02-18 13:13:55 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2025-02-16 14:20:16 +0000

Seen: 44 times

Last updated: Feb 16