blackriver Posted July 13, 2011 Share Posted July 13, 2011 I was trying to explain the workings of Airodump-ng to someone when it occurred to me I don't fully understand what the "#Data"-column is trying to show. I always assumed these were "interesting" packets, i.e. packets generated by an actual user instead of say beacons (although the manual says it's the "number of captured data packets, including data broadcast packets"). I was wondering if anyone knew how Airodump-ng determines if it sees a data packet. I tried to google but couldn't find an answer. So is it perhaps one of these? All packets minus beacons? Only TCP (and maybe UDP) packets? All packets that have a source and destination? Quote Link to comment Share on other sites More sharing options...
Jason Cooper Posted July 13, 2011 Share Posted July 13, 2011 It is referring to layer 2 data frames that it has captured. These don't include beacon frame but do include broadcast frames, they are different. The easiest way to think of it is that they are the actual frames from each computer that will reach other computers on the network. Frames like Beacon, Authentication, Deauthentication, etc. are only passed between the computer and the access point, and so aren't included as a data frame. Quote Link to comment Share on other sites More sharing options...
blackriver Posted July 13, 2011 Author Share Posted July 13, 2011 It is referring to layer 2 data frames that it has captured. These don't include beacon frame but do include broadcast frames, they are different. The easiest way to think of it is that they are the actual frames from each computer that will reach other computers on the network. Frames like Beacon, Authentication, Deauthentication, etc. are only passed between the computer and the access point, and so aren't included as a data frame. Thanks for the reply, Jason. I'm trying to understand how I could do the same with a different tool, say tcpdump. As far as I understand, tcpdump will also capture the beacons when put in monitor mode with -I. Is there a way to basically count the "data packets" in monitor mode just like airodump-ng does? Quote Link to comment Share on other sites More sharing options...
Jason Cooper Posted July 13, 2011 Share Posted July 13, 2011 I have never tried using tcpdump with are wirless interface in monitor mode, I suspect that you will have to do a bit of coding to get the results that you want or grab everything with tcpdump and then run the capture through wireshark. If you do start to investigate coding your own tool then the 802.11 standards could be useful reading. Quote Link to comment Share on other sites More sharing options...
blackriver Posted July 14, 2011 Author Share Posted July 14, 2011 I'm not sure if I'm up to coding my own tool yet, but thanks for the reading material. I wonder if this would be a good exercise in Python or Ruby: calling tcpdump and tshark, processing their output, and restart. Sounds like a weekend project! Quote Link to comment Share on other sites More sharing options...
Jason Cooper Posted July 14, 2011 Share Posted July 14, 2011 I'm not sure if I'm up to coding my own tool yet, but thanks for the reading material. I wonder if this would be a good exercise in Python or Ruby: calling tcpdump and tshark, processing their output, and restart. Sounds like a weekend project! If you are going to have a go with it look at using the pcap libraries as they will make you life easier when dealing with sniffing/captured packets. Quote Link to comment Share on other sites More sharing options...
blackriver Posted July 15, 2011 Author Share Posted July 15, 2011 Excellent advice, thanks Jason! Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.