A Case Study on the Monitor Mode Passive Capturing of WLAN Packets in an On-the-Move Setup

Ajay Prasad,Anil Kumar,Sourabh Singh Verma,Priyanka Dahiya

doi:10.1109/access.2021.3127079

Ajay Prasad, Anil Kumar + Show 2 more

Open Access

https://doi.org/10.1109/access.2021.3127079

Copy DOI

Abstract

Monitor mode packet capturing of WLAN is used to derive Access points and devices in the range for localization or occupancy purposes. The general modality of capturing and analysis in almost all available studies is to capture packets by being static (STT) at a location and indoors. In STT mode, the beacon and probe packets extract insights about the localization of devices and occupancy estimation. We propose scanning a predetermined path in an urban locality on the move (OTM) using monitor mode WLAN packet capturing. We also propose that in OTM, devices (STA) and Access Points (APs) can be traced from other packets like CTS, ATS, and ACKs apart from beacons and frames. We performed a case study of monitor mode packet capturing in an on-the-move and outdoor setup. The primary focus of the study was to validate the OTM modality and the methodology of detecting devices and APs. We studied all the packet types that were captured, including Beacons and Probes. The sensed devices and APs counts using probe and beacon packets were compared with the sensed devices, and APs counts using the new methodology. We found that considering other packets helps detect a more significant number of devices and APs. We also found that channel hoping strategy plays an essential role in maximizing the sensed items. The overall exercise revealed that the air is full of WLAN/Wi-Fi traffic, and using OTM can assimilate lots of valuable data and generate relevant information for various purposes. Essentially, on-the-move outdoor capture setups can be used to produce Wi-Fi access points and user devices related heat maps of the scanned locations. This can be useful in many governance and related matters. Briefly, we put forward an application architecture for the same.

Highlights

Connectivity is widespread, and almost everyone is connected via mobile devices like smartphones, tablets, etc
The experimental sniffer setup consisting of a Wi-Fi adapter over a laptop running kali was placed in a vehicle
Both the OTM scan and the STT captures were made through the Wireshark, and the captures were saved for analysis in pcapng file format

Summary

Introduction

Connectivity is widespread, and almost everyone is connected via mobile devices like smartphones, tablets, etc. Almost every smart device is connected to the internet via one or other means. One such means is Wi-Fi. Majorly, Wi-Fi devices are categorized into an access point (AP) or router and Wi-Fi adapter in devices(STA). Wi-Fi hotspots or Access Points (APs) can be found everywhere in an urban locality and are generally identified by their unique service names called SSID. In IEEE 802.11 wireless local area networking standards (including Wi-Fi), a service set is a group of wireless network devices which share a service set identifier (SSID)[4]. The basic service set is defined by a primary service set identifier (BSSID) shared by all devices within it.

Objectives

Results

Conclusion