vladinko0's profile - activity

Is it possible to identify Rogue Access Point with Wireshark?

Thank You.

Are there any criteria, when AP can be considered as a Rogue AP?

How to identify Rogue Access Point? Is it possible to identify Rogue Access Point with Wireshark? Thank You.

Because display filters are not supported when saving captured data with tshark I am trying to create valid cap file that I can read in Wireshark.

I capture data with tshark -x

In python I am scraping raw data with:

substring = oneline[5:53]    
clean = ''.join([c for c in substring if 34 < ord(c) < 127])    
raw_packet += clean

I am converting these data back to raw hex data:

newFile = open("filename.cap", "wb")
newFile.write(bytes.fromhex(raw_packet))

I also tried:

newFile.write(bytearray(binascii.unhexlify(raw_packet)))

or

newFile.write(binascii.unhexlify(raw_packet))

But when I am open the filename.cap in Wireshark I don't see normal packet data:

Frame 1: 260 bytes on wire (2080 bits), 260 bytes captured (2080 bits)
    Encapsulation type: JavaScript Object Notation (175)
    Frame Number: 1
    Frame Length: 260 bytes (2080 bits)
    Capture Length: 260 bytes (2080 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: json:data-text-lines] JavaScript
Object Notation Line-based text data (1 lines)
     [truncated]\000\000 \000\256@\000\240 \b\000\240
\b\000\000\020\002l\t\240\000\336\000d\000\000\000\000\000\000\001\200\000\000\000\377\377\377\377\377\377\264\373\344J\352\346\264\373\344J\352\346p!\200\201+A'\000\000\000d\0001\004\000\

Are raw data provided by tshark full?

How can I convert them back to Wireshark readable file?

Or what am I doing wrong?

Are raw data provided by tshark full? Because display filters are not supported when saving captured data with tshark I

RTL8812AU in SDU3-P7C3 hub works bad I am using USB-AC56 adapter and when it is connected directly to computers USB3 por

Sometimes I see in packets captured by Wireshark in radiotap.dbm_antsignal property positive values from 1 to 17. Shouldn't it be only negative?

Positive value of antenna signal Sometimes I see in packets captured by Wireshark in radiotap.dbm_antsignal property pos

Positive value of antena signal Sometimes I see in packets captured by Wireshark in radiotap.dbm_antsignal property posi

Positive value of antena signal Sometimes I see in packets captured by Wireshark in radiotap.dbm_antsignal property posi

Sessions of protected networks I would like to store captured packets in the database. I think it would be good to sort

But in some packets I don't have Source address, just receiver address: Type/Subtype: Acknowledgement (0x001d) Receiver

How can I find out, who has transmitted the packet? Interface is in monitoring mode. In the packet is: Source address:

I am monitoring wlan0. So if I have this: Receiver address: Broadcast (ff:ff:ff:ff:ff:ff) Destination address: Broadc

So if I have this: Receiver address: Broadcast (ff:ff:ff:ff:ff:ff) Destination address: Broadcast (ff:ff:ff:ff:ff:ff)

So if I have this: Receiver address: Broadcast (ff:ff:ff:ff:ff:ff) Destination address: Broadcast (ff:ff:ff:ff:ff:ff)

RX and TX packets identification When I am capturing packets of some intarface how can I detect which are RX and TX pack