Some packets not coming through

asked 2018-08-31 11:39:44 +0000

Anonymous

Hi. As you can tell from the title, my problem is that when sniffing on a network, some packets are not being detected by wireshark. For example, out of the 4 authentication packets for WEP, most of the times it detects about 2-3. I'm using an AWUS036NH USB card with a Kali VBox, in monitor mode and in the same channel as the AP. The physical space is crowded with WLANs on the same channel, but my very limited experience with the subject doesn't let me consider if that's enough of a problem (the AP must be getting the packets, or else data transmission wouldn't happen). Does anyone know something that may be causing this? Thanks

edit retag flag offensive close merge delete

add a comment

2 Answers

Sort by » oldest newest most voted

answered 2018-08-31 14:40:18 +0000

Bob Jones
1496 ●2 ●179 ●22 Boston, MA

Packet loss is one of the significant issues with 802.11 wifi; especially in crowded networks with heavy RF usage.

Signal strength - you want to be 'close' to the devices, but not too close... maybe 1-2 meters away. One way to analyze the data is - can you correlate the loss? In a 4-way EAPOL handshake for WPA (or are you really using WEP? If so, please migrate to a secure solution!) you get two frames in each direction. The correlation part is - are they usually the client frames, or the APs, that are lost? Then look at signal strength and try to get an RSSI of -40 to -50 for both of the devices.

As well, you could have an issue with your capture mechanism not able to collect certain frames due to modulation differences. Based on the description, doesn't sound as if that is the issue but it depends on the specific frames you do get and the ones that are missing.

Passing USB devices like this into a VM to collect traffic, I find, to be very sensitive, especially with VirtualBox. It does work sometimes, but you might want to try a native install of Linux to have more resources available to the capture process. You might be able to boot from a USB on the PC so being native is usually possible.

edit flag offensive delete link

Comments

Thank you! I am using WEP currently start learning about wireless security. (Don't worry, the router is not connected to the internet and i'm only using it to see the packets sent and received when connecting to it). Thank you for such a complete description of the complications I could have, I will try your solutions one by one

haxxorz23 ( 2018-08-31 18:22:19 +0000 )edit

I had attached a long-range antenna for capturing packets coming from devices that were in my room

haxxorz23 ( 2018-09-02 20:30:04 +0000 )edit

add a comment

answered 2018-09-02 20:28:26 +0000

haxxorz23
3 ●1 ●2

As Bob Jones pointed out, the problem had to do with the signal strength. I tried getting 2 meters away and the RSSI was about -15, which didn't match the -40 to -50 range he was talking about. After a long time of trying his well-thought solutions, I realized my retardation: I had attached a "long-range antenna" to the USB network card, thinking it would improve my connection... I don't know why I didn't think that a long-range antenna wouldn't have some problem with such close ranges. Anyways, thank you Bob for you did point me in the right direction and it's not your duty to state the obvious solutions.

edit flag offensive delete link

add a comment