Dumping Beacon frames using the WiFi Native API

Some time ago I released wwtool that was able to do some information gathering using wireless interface that work on Windows and I promise to add some features, one of this was to dump wireless frames to a pcap file.

I'm going to explain how we are able to reassemble Beacon frames using the WiFi Native API.

Before starting we need first to understand what a Beacon frame has inside. On the image below we are going to see the content of this frame.

To do the magic we are going to use the WlanGetNetworkBssList function that retrieves a list of BSS entries of the wireless network on a given wireless interface. This BSS entries are handed to us on the WLAN_BSS_ENTRY structure and we know that this information is gather through Beacon and Probe Response frames. This two frames are almost identical on their content, so we are going to treat all as Beacons because it would be almost impossible to distinguish one from other from the API.

Below we can see the declaration of the WLAN_BSS_ENTRY structure.

typedef struct _WLAN_BSS_ENTRY {

DOT11_SSID        dot11Ssid;
  ULONG             uPhyId;
  DOT11_MAC_ADDRESS dot11Bssid;
  DOT11_BSS_TYPE    dot11BssType;
  DOT11_PHY_TYPE    dot11BssPhyType;
  LONG              lRssi;
  ULONG             uLinkQuality;
  BOOLEAN           bInRegDomain;
  USHORT            usBeaconPeriod;
  ULONGLONG         ullTimestamp;
  ULONGLONG         ullHostTimestamp;
  USHORT            usCapabilityInformation;
  ULONG             ulChCenterFrequency;
  WLAN_RATE_SET     wlanRateSet;
  ULONG             ulIeOffset;
  ULONG             ulIeSize;
} WLAN_BSS_ENTRY, *PWLAN_BSS_ENTRY;

If we compare the content of the frame from the information we can get from the Windows API, we see that we are missing some portions of the frame.

We are able to assume the content of some fields and fix the value of others to reassemble the frames:

• Frame Control Version is 0x0.
• Frame Control Type is set to Management and Subtype to Beacon.
• Frame Control Flags are always 0x0 on Beacon and Probe Response frames.
• Duration is always 0x0.
• Destination is set to broadcast as on the Beacon frames.
• Source Address is the same as the BSSID and we can get this from the WLAN_BSS_ENTRY structure.
• Management frames couldn't be fragment, so be set fragment field to 0.
• We set sequence number to a fixed value of 0.
• Timestamp, beacon interval and capabilities fields are available on the WLAN_BSS_ENTRY structure.
• We get all the information elements of the frame using the ulIeOffset and ulIeSize from the WLAN_BSS_ENTRY structure.

Finally the only thing we are missing is to store this frames in a file using the Pcap file format (http://wiki.wireshark.org/Development/LibpcapFileFormat).

As we saw this is not so hard to do, and we are able to do some sort of "sniffing" with wireless interfaces on Windows platform.

To those that don't want to do all the coding I uploaded the source code to my GitHub repository(https://github.com/6e726d). The code can be build using Visual Studio Express Edition.

And the others that only want the binary file, you can download it from here.