As you've learned, there are a few different Wi-Fi 6E APs in this room.
There is an tri-radio tri-band Aruba AP-635 on channel 85 broadcasting 8 SSIDs.
Let's capture on channel 85 to see how these 8 SSIDs are split up.
Do you think these are all in one MBSSID frame? Or perhaps are they in multiple MBSSID frames?
There are two different Wi-Fi 7 APs in this room.
This AP is broadcasting on multiple channels including 6 GHz.
This AP is broadcasting on multiple channels including 6 GHz.
Take captures of both and compare and contrast the information elements to determine which supports MLO.
The answer is currently only the TP-Link Archer BE550. It is the only AP broadcasting the Multi-Link Element (MLE). This information element indicates support for Multi-Link Operation. \
The UniFi U7 will get MLO support in an upcoming firmware release.
Let's see if we can sniff some Wi-Fi traffic on 2.4, 5 GHz, and 6 GHz!
Now that we've set up our Mac to allow us to capture and decode Wi-Fi frames via the WLAN Pi M4, let's capture some frames and see what's going on in our test lab.
We'll work through some simple examples of capturing frames on the 2.4 GHz, 5 GHz, and 6 GHz bands. You may choose to do as many or a few of the examples as you choose.
The lab will look at the following areas:
Customizing the Wireshark UI to provide better decoding for Wi-Fi frames
How to start and stop a capture, how to start a new capture
Capturing on 2.4 GHz:
Beacon frames
Capturing on 5 GHz:
Reduced Neighbor Reports
Capturing on 6 GHz:
Fast Initial Link Setup (FILS) frames
A Mac with Airtool 2 installed as per the previous setup instructions. The Mac should be associated to one of the lab APs for connectivity to the WLAN Pi M4.
A WLAN Pi M4. This should be connected to a lab switch to provide both power and network connectivity.
The default coloration of Wireshark frame decodes is a fairly bland black-and-white presentation, which makes picking out the different frame types and getting a sense of the traffic flows quite tricky.
MetaGeek provides an excellent customization file that colorizes different Wi-Fi frame types and makes interpreting hundreds of frames in a capture file far more manageable. Once installed, it allows you to switch to a new "MetaGeek" profile within Wireshark to see the new options that the file provides.
The following MetaGeek page provides access to the customization file and installation instructions. It is strongly recommended that you install this profile if time allows:
To start a capture using the WLAN Pi, select your WLAN Pi from the Airtool 2 menu (your WLAN Pi may be under the "Remote Capture" menu if you did not select it as a favorite during setup):
A pop-up for the probe appears, allowing the selection of the WLAN Pi's capture interface, band, channel, and channel width:
The first time you use the sensor, you will also be prompted to enter the login credentials for the WLAN Pi:
Wireshark will now open and display the frames being captured by the WLAN Pi.
To stop the capture, hit the red square button on the top bar of Wireshark:
To start a new capture, you need to quit Wireshark completely. You can then select the sensor again to start a new capture.
When you are done capturing, you need to quit Wireshark before starting a new capture. Otherwise, you will find the remote sensor 'greyed out.'
Let's start with a simple capture on the 2.4 GHz band. Use the lab AP channel number(s) discovered in the previous Wi-Fi scanning lab for your capture.
Use Airtool to start a capture as shown below (adjust for the channel being used by the lab AP):
Leave the capture going for a few seconds to gather a selection of frames. Stop the capture and review the captured frames. Can you spot any beacon frames?
To filter the Wireshark display to show just beacon frames, enter the following display filter:
Take a look at the frame detail of several of the beacon frames. Can you find:
The beacon's SSID name?
The AP's country code?
The channel utilization in the QBSS load element?
Repeat the capture process of the previous example, but this time capture frames from a 5 GHz channel. Again, use the lab AP channel number(s) discovered in the previous Wi-Fi scanning lab for your capture.
Use Airtool 2 again as follows (corrected for your local AP channel):
While the capture is running, use your phone to try to associate to the lab SSID (don't worry about having the correct PSK to join the network). This will initiate probe requests from your client device and probe responses from the AP.
Stop the capture and apply the display filter shown below:
If all went well, you'll have a few probe responses and will be able to inspect the tagged parameters in the probe response.
Scroll through the tags and identify the "Reduced Neighbor Report" tag. Expand and take a look at the available fields. This is the tag that identifies the 6 GHz channels that the AP is also operating on. Can you see which 6 GHz channel the lab AP is operating on?
Finally, let's capture frames on the 6 GHz band.
We'll initiate the capture as in the previous two examples. Again, use the lab AP channel number(s) discovered in the previous Wi-Fi scanning lab for your capture.
Fire up a capture as follows (corrected for your local AP channel):
Leave the capture running for a few seconds and then stop it to review the frames collected.
If we're capturing on a channel where this is an AP operating as 6-GHz only from Aruba, we should we numerous "Action" frames. There is an action frame at least every 20 ms. Let's take a closer look at these to find out what's going on here.
Apply the following display filter:
An Aruba AP only broadcasts FILS when it is operating as 6-GHz only. If there is any VAP operating in 2.4 GHz or 5 GHz on an adjacent radio, FILS is disabled automatically. If you do not see these action frames, you'll need to ask the instructor which channel to scan on to discover the AP which is operating as 6-GHz only.
The frames we're seeing are Fast Initial Link Setup (FILS) discovery announcement frames. They're a kind of condensed beacon for the Wi-Fi 6E world.
You can read more about them here:
Finally, if you have time, apply a new display filter to your captured frames to display the beacons captured:
Expand the "HE Capabilities" tagged parameter. Expand the HE PHY Capabilities Information section and take a look at the capabilities information. Does your AP support 160 MHz channels on 6 GHz?
You're all done! Well done on completing this frame capture lab.
Now that our Windows device is set up to allow us to capture and decode Wi-Fi frames via the WLAN Pi M4, let's capture some frames and see what's going on in our test lab.
We'll work through some simple examples of capturing frames on the 2.4 GHz, 5 GHz, and 6 GHz bands. You may choose to do as many or a few of the examples as you choose.
The lab will look at the following areas:
Customizing the Wireshark UI to provide better decoding for Wi-Fi frames.
How to start and stop a capture, and how to start a new capture.
Capturing on 2.4 GHz:
Beacon frames
Capturing on 5 GHz:
Reduced Neighbor Reports
Capturing on 6 GHz:
Fast Initial Link Setup (FILS) frames
A Windows laptop with Wireshark 4.0.2 or higher installed as per the previous setup instructions. The Windows laptop should be associated to one of the lab APs so that it can contact the WLAN Pi.
A WLAN Pi M4. This should be connected to a lab switch to provide both power and network connectivity.
The default coloration of Wireshark frame decodes is a fairly bland black-and-white presentation, which makes picking out the different frame types and getting a sense of the traffic flows quite tricky.
MetaGeek provides an excellent customization file that colorizes different Wi-Fi frame types and makes interpreting hundreds of frames in a capture file far more manageable. Once installed, it allows you to switch to a new "MetaGeek" profile within Wireshark to see the new options that the file provides.
The following MetaGeek page provides access to the customization file and installation instructions. It is strongly recommended that you install this profile if time allows:
The procedure for starting a capture was covered back in the setup section of this packet capture guide. Let's summarize it below:
Open Wireshark and select 'Wi-Fi remote capture' in the list of available interfaces. This launches the Wi-Fi remote capture UI:
Complete the fields in the 'Capture', Server and Authentication sections of the remote capture UI:
Capture:
Remote Wi-Fi Interface name: 'auto' or 'wlan0' on the WLAN Pi M4
Remote Wi-Fi Channel: the channel on which frames are to be captured by the WLAN Pi M4
Remote Wi-Fi channel width: channel width used by the AP transmitting frames to be captured (20, 40, or 80 MHz)
Server:
Remote SSH server address: IP address of the WLAN Pi M4
Remote SSH Server port: port used for SSH communication to the WLAN Pi (this will generally be port 22)
Authentication:
Remote SSH server username: username of the account used to access the WLAN Pi M4 (usually 'wlanpi')
Remote SSH server password: password of the account used to access the WLAN Pi M4
Path to SSH private key: (not used in this lab) filename of private key (if used) on WLAN Pi M4. This is used in place of the previous username/password field values.
Hit the 'Start' button to start the capture. After a few seconds, the captured frames will be displayed in the Wireshark UI. The capture process will continue until manually stopped.
If you relaunch Wireshark and decide to start a subsequent capture, you may see the following error.
Unfortunately, Wireshark does not remember your password between sessions. Every time you launch Wireshark, you will need to re-enter your password before starting a new capture.
We can work around this limitation by configuring password-less SSH access. Covered in an upcoming bonus lab.
To stop a capture, hit the red square button on the top bar of Wireshark:
Let's start with a simple capture on the 2.4 GHz band. Use the lab AP channel number(s) discovered in the previous Wi-Fi scanning lab for your capture.
Use the remote capture utility to start a capture on the 2.4 GHz band as shown below (adjust for the channel being used by the lab AP):
Leave the capture going for a few seconds to gather a selection of frames. Stop the capture and review the captured frames. Can you spot any beacon frames?
To filter the Wireshark display to show just beacon frames, enter the following display filter:
Take a look at the frame detail of several of the beacon frames. Can you find:
The beacon's SSID name?
The AP's country code?
The channel utilization in the QBSS load element?
Repeat the capture process of the previous example, but this time capture frames from a 5 GHz channel. Again, use the lab AP channel number(s) discovered in the previous Wi-Fi scanning lab for your capture.
Use the remote capture utility again as follows (corrected for your local AP channel):
While the capture is running, use your phone to try to associate to the lab SSID (don't worry about having the correct PSK to join the network). This will initiate probe requests from your client device and probe responses from the AP.
Stop the capture and apply the display filter shown below:
If all went well, you'll have a few probe responses and will be able to inspect the tagged parameters in the probe response.
Scroll through the tags and identify the "Reduced Neighbor Report" tag. Expand this and take a look at the fields available. This is the tag that identifies the 6 GHz channels that the AP is also operating on. Can you see which 6 GHz channel the lab AP is operating on?
Finally, let's capture frames on the 6 GHz band.
The driver indicated by FPMS will showmt7921e
regardless of your installed MT7921K or MT7922 hardware. The driver is for either.
FPMS > Network > WLAN Interfaces > Driver
We'll initiate the capture as in the previous 2 examples. Use the channel number(s) discovered in the previous Wi-Fi scanning lab for your capture.
Fire up a capture as follows (correct the channel for your local AP channel):
Leave the capture running for a few seconds and then stop it to review the frames collected. Notice that there are numerous "Action" frames. There is an action frame at least every 20 ms. Let's take a closer look at these to find out what's going on here.
Apply the following display filter:
The frames we're seeing are Fast Initial Link Setup (FILS) discovery announcement frames. They're a kind of condensed beacon for the Wi-Fi 6E world. You can read more about them here:
Finally, if you have time, apply a new display filter to your captured frames to display the beacons captured:
Expand the "HE Capabilities" tagged parameter. Expand the HE PHY Capabilities Information section and checkout the capabilities information. Does your AP support 160 MHz channels on 6 GHz?
You're all done! Well done on completing this frame capture lab.