Thursday, September 30, 2010

Wireshark makes mistake; Calls CCMP encrypted wireless data frames as TKIP !

Have you ever been bugged by Wireshark protocol analyzer tool? If yes, what was the last anomaly you found in it? For me, it seems to be wireless data frame dissector making mistake in decoding wireless data frame encryption type.

Wireshark, earlier known as Ethereal, is one of the most popular open source protocol analysis tool and frequently used by network and security analysts all over the world to analyze the performance or security of a protocol/network.


Figure 1: WPA2-CCMP Enabled APs

Just a few days back, I was analyzing an IEEE 802.11i enabled Wi-Fi network and found an anomaly in the behavior of the wireless network operation as shown by the Wireshark version 1.4.0. Wireless data frames exchanged between a WPA2-AES configured wireless client and an access point was marked as CCMP encrypted, which was obvious but a few data frames were marked as TKIP encrypted which raised the suspicion. 


Figure 2


How could WPA2-AES (and Mixed mode) configured wireless client or AP transmit TKIP encrypted data frames?

So, I decided to investigate it further. This blog post is about my findings on this issue.

As we all know, there are three types of data frame encryption algorithms used in Wi-Fi networks depending upon the type of security configured for example WEP secured WiFi network uses WEP encryption technique while WPA and WPA2 secured WiFi network use TKIP and CCMP respectively.

Can we accurately identify the encryption type just by analyzing the information present in the wireless data frame encryption header? And the answer is Yes.  How? Let’s first take a close look of encrypted data frames and see how it appears in the air.

1.    WEP Encrypted Data Frame Format
Figure 3: WEP Frame Format


WEP encrypted data frames contain only 4 bytes of encryption header. First three bytes are Initialization Vector (IV) which is used in the WEP encryption/decryption process.  Two most significant bits of the fourth byte are used to indicate the encryption key number to be used in the data frame encryption/decryption. Least significant six bits are always kept zero. 


2.   TKIP Encrypted Data Frame Format
Figure 4: TKIP Frame Format


TKIP encrypted data frame contains eight bytes of encryption header. Third and first bytes along with the last four bytes of the header are used in the TKIP encryption/decryption process.  Second byte is called WEPSeed. WEPSeed is not used in TKIP encryption but it is set to (TSC1 | 0x20 ) & 0x7F.

Three most significant bits of the fourth byte are used to indicate the key number and the presence of extra four bytes in the encryption header. Least significant three bits are always kept zero.


3.   CCMP Encrypted Data Frame Format
Figure 5: CCMP Frame Format

CCMP encrypted data frame contains eight bytes of encryption header (shown as CCM header in Figure 4). First and second bytes along with the last four bytes of the header are used in the CCMP encryption/decryption process.  Third byte is reserved and always kept as zero.

Three most significant bits of the fourth byte are used to indicate the key ID and presence of extra four bytes in the CCMP header. Least significant three bits are always kept zero.



Now one can easily identify WEP encrypted data frames as it contains only four bytes of encryption header and six least significant bits of the fourth byte are always zero while TKIP and CCMP encrypted data frames have only five least significant bits of the fourth byte as zero.

Distinguishing between a TKIP encrypted data frame and a CCMP encrypted data frame is bit tricky. We can make use of the difference in first three bytes of encryption header of TKIP and CCMP.

Test1: All TKIP encrypted data frames should have WEPSeed byte (2nd byte of eight bytes encryption header) set to (TSC1 | 0x20) & 0x7F.

Test2: All CCMP encrypted data frames should have third byte of eight bytes CCMP header set to zero.

Let's examine the packet trace in the light of above two tests. Let's assume that selected data frame shown in Figure 2 is correctly identified by Wireshark as TKIP encrypted data frame. So, TSC1 is 0x91, WEPSeed is 0xAB and TSC0 is 0x00. According to Test 1,

WEPSeed = (TSC1 | 0x20) & 0x7F

              = (0x91 | 0x20) & 0x7F
              = 0xB1 & 0x7F
              = 0x31

But the actual WEPSeed present in the data frame is 0xAB.

Hence the condition to be a TKIP encrypted data frame is not satisfied by the selected frame shown in Figure 2.

According to Test 2, CCMP encrypted data frames have third byte zero. Third byte of the selected frame in Figure 2 is actually 0 which confirms that it is CCMP encrypted data frame.

So we have confirmed that frame shown in Figure 2 is not TKIP encrypted but CCMP encrypted data frame and there is some problem with the Wireshark dissector.

Few CCMP encrypted data frames may have encryption header such that third byte is zero but second byte is equivalent to (First Byte | 0x20) & 0x7F. Under these conditions it would be difficult to find out encryption type just by seeing encrypted data frames.

It would be difficult to build a perfect detector but few other conditions can be taken into account in order to predict encryption type. For example in TKIP encrypted data frames, third byte of the encryption header is LSB of Transmit Sequence Counter (TSC) while in CCMP encrypted data frames, first byte of the encryption header is LSB of Packet Number (PN). This means in two consecutive transmitted frames, third byte will increment if the frame is TKIP encrypted else first byte will increment if the frame is CCMP encrypted.

Though, the difficulty of building perfect Wireshark detector to detect encryption type of data frame can be understood, why the designers of the standard chose to assign different name and meaning to individual octet of encryption header is vague.


If you know any reasons of the dissimilarity of TKIP and CCMP encryption header, kindly do share with us.

44 comments:

  1. Hi
    I just found your blog and this document is quite helpful for me. But I am not fully understand the last third paragraph in which you mention about the third byte in TKIP header and first byte of CCMP header. Could you use figure 1 to explain to me. Because I use my wireshark for a test, there is a data frame which is encrypted by TKIP. The TKIP IV shown in the 'Packet Bytes' Layout is 'e3 63 cf 60 03 00 00 00' and the sequence number is 2259, the fragment number is 0. In the 'Packet Bytes' layout, it is shown as '30 8d'. Maybe I wrongly calculate the LSB, because I didn't find the LSB and 3rd byte in TKIP header matching each other. Thanks!

    ReplyDelete
  2. There may be times you are be bothered by anonymous free business calls. They can cause you to be rattled or disturbed emotionally. Don't take them lightly; they can also be life threatening. Equip yourself with a good personal screening tool.

    ReplyDelete
  3. Many people are aware of Google's official Android market. While the market is great, the unfortunate thing is that not every app is available there. Also, not every Android device can access the market. Due to these reasons, it's imperative that you know other places where you can download Android apps. Here are some of the best places: weblink

    ReplyDelete
  4. Music began playing any time I opened this website, so frustrating! Mega888 apk download

    ReplyDelete
  5. Rattling clean internet site , thanks for this post. 안전놀이터

    ReplyDelete
  6. I was also reading a topic like this one from another site..*.”‘ Dallas' Matthew Fleeger

    ReplyDelete
  7. Security Cameras have proven to be an invaluable tool in catching criminals, and many felons who would otherwise be free are now behind bars. Those we hire to protect us and enforce the law are not always immune to the lure of criminal activity unfortunately, and security cameras record the truth without prejuduice and help us to weed out the rotten apples and punish them equally as they deserve. how to make a homemade spy kit

    ReplyDelete
  8. I discovered your blog web site on google and test a few of your early posts. Continue to keep up the superb operate. I simply extra up your RSS feed to my MSN News Reader. In search of forward to studying extra from you afterward!… 188

    ReplyDelete
  9. “I simply had to appreciate you all over again. I am not sure the things that I would’ve accomplished in the absence of the type of points contributed by you concerning this concern. It had been the fearsome case for me personally, but coming across the professional form you resolved the issue made me to weep over happiness. I will be happier for the work and thus pray you know what a great job that you’re getting into educating most people thru your webpage. I am certain you’ve never got to know any of us.” buy steroids

    ReplyDelete
  10. I truly enjoy examining on this website , it has good content . canaries for sale

    ReplyDelete
  11. I would like to show my thanks to you just for bailing me out of this problem. Right after researching through the world wide web and seeing strategies which are not helpful, I figured my entire life was gone. Existing minus the approaches to the issues you’ve fixed through your main guideline is a crucial case, and ones that would have in a negative way damaged my entire career if I hadn’t discovered your website. Your primary ability and kindness in playing with all things was precious. I am not sure what I would have done if I hadn’t come across such a solution like this. I’m able to at this moment look forward to my future. Thanks for your time very much for this impressive and result oriented guide. I won’t be reluctant to refer the sites to any person who should receive direction on this problem. cloud application development platform

    ReplyDelete
  12. LCD TVs can really save you from high electricity bills and office space* Francasino

    ReplyDelete
  13. very good post, i definitely love this site, keep on it 힙합토토

    ReplyDelete
  14. you can always count on Universal Studios when you want some great action., 토토사이트 태평양

    ReplyDelete
  15. It’s rare knowledgeable individuals about this topic, however you sound like what happens you are referring to! Thanks ผู้สร้างลิงค์

    ReplyDelete
  16. every woman loves to wear those pretty but expensive diamond rings, i would love to give my girlfriend a diamond ring” steroids for sale

    ReplyDelete
  17. My brother recommended I would possibly like this blog. He was totally right. This publish truly made my day. You can not believe just how a lot time I had spent for this info! Thanks! steroids for sale

    ReplyDelete
  18. if you always use your swimming pools, you will need to use some quality pool cleaner a lot“ buy hgh

    ReplyDelete
  19. Awesome article, it was exceptionally helpful! I simply began in this and I'm becoming more acquainted with it better. The post is written in very a good manner and it contains many useful information for me. Thank you very much and will look for more postings from you . Nice to be visiting your blog once more, it has been months for me. Well this article that ive been waited for therefore long. i want this article to finish my assignment within the faculty, and it has same topic together with your article. Thanks, nice share. Outstanding information.This blog looks just like my old one! It’s on a completely different topic 먹튀검증

    ReplyDelete
  20. This is truly a pleasant and instructive, containing all data furthermore greatly affects the new innovation. A debt of gratitude is in order for sharing it . I have perused a couple of the articles on your site now, and I truly like your style of blogging. Positive site, where did u think of the data on this posting? I'm satisfied I found it however, sick be inquiring soon to figure out what extra posts you incorporate. I added it to my top picks web journal website list and will be inquiring soon. It would be ideal if you look at my site also and let me comprehend what you think. This is great. I read this post and enjoyed a lot. Its too much informative and I want to keep it bookmark for future use. Thanks 먹튀검증소

    ReplyDelete
  21. Only aspire to mention ones content can be as incredible. This clarity with your post is superb and that i may think you’re a guru for this issue. High-quality along with your concur permit me to to seize your current give to keep modified by using approaching blog post. Thanks a lot hundreds of along with you should go on the pleasurable get the job done. You have beaten yourself this time, and I appreciate you and hopping for some more informative posts in future. Thank you for sharing great information to us. I think this is a standout amongst the most critical data for me. What"s more, i"m happy perusing your article. Be that as it may, ought to comment on some broad things 먹튀검증

    ReplyDelete
  22. Every one of the substance you said in post is too great and can be extremely helpful. I will remember it, much obliged for sharing the data continue upgrading, looking forward for more posts.Thanks . Decent to be going to your web journal once more, it has been months for me. Well this article i've been sat tight for so long. I require this article to finish my task in the school, and it has same theme with your article. Much obliged, awesome offer. This is such an extraordinary asset, to the point that you are giving and you give it away for nothing. I cherish seeing sites that comprehend the benefit of giving a quality asset to free. It is the old what circumvents comes around schedule. 먹튀폴리스

    ReplyDelete
  23. You have noted very interesting details ! ps decent site. Excellent goods from you, man. I have understand your stuff previous to and you are just too great. I actually like what you’ve acquired here, certainly like what you’re saying and the way in which you say it. You make it enjoyable and you still care for to keep it wise. I can not wait to read far more from you. This is really a wonderful site. I think this is an informative post and it is very useful and knowledgeable. I just tripped upon your blog and ached to say that I have really enjoyed reading your blog post. Thank you for sharing. Thank a lot. You have done excellent job. I enjoyed your blog . Nice efforts . 메이저놀이터

    ReplyDelete
  24. I really enjoyed reading your article. I found this as an informative and interesting post, so i think it is very useful and knowledgeable. I would like to thank you for the effort you have made in writing this article . What an Excellent post. I really found this to much informatics. It is what i was searching for.I would like to suggest you that please keep sharing such type of info. Great post, you have pointed out some excellent points, I as well believe this is a very superb website. You have done a great job on this article. It’s very readable and highly intelligent. You have even managed to make it understandable and easy to read. You have some real writing talent. Thank you. 엔트리파워사다리

    ReplyDelete
  25. Thanks for every other informative site. The place else may just I get that kind of information written in such an ideal means? I have a venture that I’m just now operating on, and I have been on the look out for such information. Subsequently, after spending many hours on the internet at last We've uncovered an individual that definitely does know what they are discussing many thanks a great deal wonderful post. I like review goals which understand the cost of passing on the marvelous strong asset futile out of pocket. I truly revered investigating your posting. Appreciative to you! 토토커뮤니티

    ReplyDelete
  26. This is an awesome rousing article.I am practically satisfied with your great work.You put truly exceptionally supportive data. Keep it up. Continue blogging. Hoping to perusing your next post. I want to share good information. Get good information. I will get good information. Everyone will have a hard time due to the corona, but please do your best. I hope that the corona will disappear soon. It would be hard for everyone, but I hope that the more I will endure and get good results. Thank you . That appears to be excellent however i am still not too sure that I like it. At any rate will look far more into it and decide personally! 메이저사이트

    ReplyDelete
  27. Thanks a lot for being my mentor on this issue. My spouse and i enjoyed your article very much and most of all liked how you really handled the aspect I widely known as controversial. You happen to be always incredibly kind to readers really like me and assist me in my life. Thank you. I was surfing the Internet for information and came across your blog. I am impressed by the information you have on this blog. It shows how well you understand this subject. The appearance efficiently excellent. Every one of these miniscule information and facts will be designed working with wide range of track record practical experience. I like it a lot. Cool you write, the information is very good and interesting, I'll give you a link to my site. 우리카지노

    ReplyDelete
  28. I think this is an enlightening post and it is extremely helpful and educated. in this way, I might want to thank you for the endeavors you have made in composing this article. Very interesting, good job and thanks for sharing such a good blog. your article is so convincing that I never stop myself to say something about it. You’re doing a great job. Keep it up. Your web log isn't just helpful however it is moreover truly innovative as well. There have a tendency to be relatively few individuals who can positively compose not all that straightforward posts that masterfully.. 파워볼

    ReplyDelete
  29. I am incapable of reading articles online very often, but I’m happy I did today. It is very well written, and your points are well-expressed. I request you warmly, please, don’t ever stop writing. I think this is an informative post and it is very useful and knowledgeable. therefore, I would like to thank you for the efforts you have made in writing this article. Acknowledges for paper such a beneficial composition, I stumbled beside your blog besides decipher a limited announce. I want your technique of inscription...It is very good, but look at the information at this address 토토사이트

    ReplyDelete
  30. I am still learning of your stuff, and i am attempting to achieve my objectives. I completely adore reading through all that is written in your website. Maintain the actual ideas arriving for long term ! Thanks ! Great info! I recently came across your blog and have been reading along. I thought I would leave my first comment. I don’t know what to say except that I have. I discovered your this post while taking a gander at for some related information on blog search...It's a not all that horrendous post..keep posting and invigorate the information. I’m sure it is the most vital information for me personally. And i am glad reading your article. But should remark on few general things, Your website style is ideal, the articles really is excellent . 메이저사이트

    ReplyDelete
  31. Can I recently say thats a relief to locate somebody that really knows what theyre referring to on the internet. You certainly have learned to bring a concern to light to make it essential. The diet really need to look at this and understand why side from the story. I cant believe youre less well-liked since you certainly possess the gift. buy steroids

    ReplyDelete
  32. This article discusses the changes in the way businesses market their services. It will concentrate on the benefits of mobile marketing and the pros and cons of mobile applications and mobile websites. singapore top mobile app developer

    ReplyDelete
  33. This is a good post. This post gives truly quality information. I’m definitely going to look into it. Really very useful tips are provided here. Thank you so much. Keep up the good works. Nice to be visiting your blog again, it has been months for me. Well this article that i’ve been waited for so long. I need this article to complete my assignment in the college, and it has same topic with your article. Thanks, great share. I was surfing net and fortunately came across this site and found very interesting stuff here. Its really fun to read. I enjoyed a lot. Thanks for sharing this wonderful information. 먹튀검증

    ReplyDelete
  34. Awesome article, it was exceptionally helpful! I simply began in this and I'm becoming more acquainted with it better! Cheers, keep doing awesome! I invite you to the page where you can read with interesting information on similar topics. Impressive web site, Distinguished feedback that I can tackle. Im moving forward and may apply to my current job as a pet sitter, which is very enjoyable, but I need to additional expand . But you've done it so calmly and with so cool feeling and you've nailed the job. This article is possessed with style and I am giving good compliment. Best! 토토마블

    ReplyDelete
  35. I'm intrigued, I should say. Really once in a while do I experience a blog that is both educative and engaging, and point of fact, you have hit the nail to the head. Your idea is remarkable; the issue is something that too little individuals are talking cleverly about. My business is enchanted that I ran over this in my search out something identifying with this. This is truly animating, You're a genuinely fit blogger. I've joined with your feed moreover expect perusing your incredible reviews. Besides, We've imparted your page to our long range informal communication destinations. I'm extremely delighted in for this blog. It's an instructive theme. It help me particularly to take care of certain issues. Its chance are so phenomenal and working style so rapid. I figure it very well might be help every one of you. Much appreciated. 안전놀이터순위

    ReplyDelete
  36. Interesting and clear business card company.Great blog design. I like to follow your creative ideas in blogging. If you are looking for high-quality text on any topic, will help you at any time of the day quickly and efficiently. Keep delighting us with new posts! I have express a few of the articles on your website now, and I really like your style of blogging. I added it to my favorite’s blog site list and will be checking back soon . Great, i must say and thanks for sharing this informative post.I am really impressed that there is so much information about this subject that have been uncovered and you’ve done your best. 사설토토꽁머니

    ReplyDelete
  37. Ultimately, this blog enables in growing certain abilties which in turn useful in imposing those abilities. Thanking the blogger for handing over such a stunning content material and hold posting the contents in upcoming days. I locate it very thrilling and thoroughly notion out and prepare. I stay up for reading your paintings in the destiny "your website is very exceptional, and it is very helping us this post is particular and exciting, thanks for sharing this excellent records. And visit our weblog web site additionally. High-quality article! This is the sort of statistics that are supposed to be shared throughout the internet. Thanks for sharing the sort of beneficial publish. Very exciting submit! I regularly observe this kind of blog" that is a magnificent article, given such an great degree of facts in it, these type of articles maintains the clients fervor for the web site, and continue sharing greater ... Nice conditions . I'm able to’t consider focusing long sufficient to investigate; a lot less write this kind of article. You’ve outdone yourself with this cloth truly. It's far one of the greatest contents . I genuinely cherished reading your weblog. It become thoroughly authored and clean to undertand. Unlike additional blogs i have examine which are definitely now not tht accurate. I also observed your posts very interesting. In reality after reading, i had to move display it to my friend and he ejoyed it as nicely! Within the wake of perusing your article i was shocked. I understand which you clarify it surprisingly well. 모두의토토

    ReplyDelete
  38. I am so thrilled I found your blog, I am here now and could just like to say thank for a tremendous post and all round interesting website. Please do keep up the great work. I cannot be without visiting your blog again and again. this is really very helpful article. I go through this site really very nice information.thank for sharing such a nice information. A very Wonderful blog. We believe that you have a busy, active lifestyle and also understand you need marijuana products from time to time. Admiring the time and effort you put into your blog and detailed information you offer!.. 토토패밀리

    ReplyDelete
  39. very interesting post. This is my first time visit here. I found so many interesting stuff in your blog especially its discussion.. thanks for the post! This is an excellent post I seen thanks to share it. It is really what I wanted to see hope in future you will continue for sharing such a excellent post. I wanted to thank you for this excellent read!! I definitely loved every little bit of it. I have you bookmarked your site to check out the new stuff you post. Positive site, where did u come up with the information on this posting?I have read a few of the articles on your website now, and I really like your style. Thanks a million and please keep up the effective work. 먹튀대피소

    ReplyDelete
  40. I've been searching the net for fun and came upon your website. Splendid submit. I am glad to find your distinguished manner of writing the publish. Now you are making it easy for me to apprehend and implement the idea . In contrast to additional blogs i have study which might be definitely now not tht desirable. I also determined your posts very interesting. In truth after analyzing, i needed to cross show it to my friend and he ejoyed it as properly! I sense strongly that love and study greater on this topic. If feasible, which include advantage know-how, would you thoughts updating your blog with additional records? It's far very useful for me . High-quality blog. I enjoyed reading your articles. This is simply a terrific examine for me. I have bookmarked it and i am looking ahead to studying new articles. Keep up the coolest work . 온카맨

    ReplyDelete
  41. I will’t agree with focusing lengthy sufficient to research; a lot much less write this sort of article. You’ve outdone yourself with this cloth really. It's far one of the best contents. I sense very thankful that i study this. It is very helpful and really informative and that i really discovered a lot from it . This is a tremendous article, given any such super amount of records in it, those type of articles continues the customers enthusiasm for the web page, and continue sharing more ... Thank you for sharing terrific records. It's miles excellent to study such terrific content. Thanks for the submit. Thanks, biomiracle products performs a major function and it isn't always best for the beauty reason however it also works to maintain us healthy. Our products will defend your skin from zits, wrinkles, darkcircles and tightens your skin with none infection. Exciting topic for a weblog. 카이소

    ReplyDelete
  42. It is a completely interesting blog publish.I often visit your posts for my project's help about Diwali Bumper Lottery and your super writing capabilities genuinely go away me taken aback.Thank you a lot for this publish. This is an extraordinary element for sharing this useful message. I am dazzled by the information you have on this blog. It causes me from multiple points of view. A debt of gratitude is in order for posting this once more. Excellent blog here! Additionally your web site a lot up very fast! What host are you using? Can I am getting your associate hyperlink for your host? I wish my site loaded up as fast as yours 카지노마트

    ReplyDelete
  43. Top 10 Tips For Beginning 안전토토사이트 Players - Part 1 - with Casino Gambling Expert Steve Bourie

    ReplyDelete