Wireshark is a powerful network protocol analyzer that allows you to capture and inspect network traffic. One of the features it provides is the ability to capture WiFi packets and analyze their contents. In this article, we will discuss how to reassemble Wireshark WiFi captured LLC (Logical Link Control) packets into their original messages.
Understanding Wireshark WiFi Captured LLC Packets
When you capture WiFi packets using Wireshark, you may notice that some of the packets are labeled as LLC. LLC is a sublayer of the Data Link Layer in the OSI model and is responsible for managing communication between devices on a local network. These LLC packets contain important information that needs to be reassembled to understand the original message.
Steps to Reassemble Wireshark WiFi Captured LLC Packets
Follow the steps below to reassemble Wireshark WiFi captured LLC packets into their original messages:
Step 1: Capture WiFi Packets with Wireshark
First, you need to capture WiFi packets using Wireshark. Make sure you have a WiFi adapter that supports packet capturing. Open Wireshark and select the WiFi adapter from the list of available interfaces. Start the capture and let it run for a while to capture enough packets.
Step 2: Filter for LLC Packets
Once you have captured enough packets, you need to filter for LLC packets. To do this, enter "llc" in the filter box at the top of the Wireshark window and press Enter. This will display only the LLC packets in the packet list.
Step 3: Identify the LLC Protocol
LLC packets can use different protocols, such as Ethernet, Token Ring, or FDDI. To reassemble the packets correctly, you need to identify the LLC protocol used. Look for the "DSAP" (Destination Service Access Point) and "SSAP" (Source Service Access Point) fields in the packet details. These fields indicate the LLC protocol used.
Step 4: Reassemble the Packets
Now that you know the LLC protocol used, you can proceed with reassembling the packets. Right-click on an LLC packet in the packet list and select "Follow > LLC." This will open a new window showing the reassembled message.
Step 5: Analyze the Reassembled Message
Once the packets are reassembled, you can analyze the contents of the message. Look for any relevant information, such as source and destination addresses, data payloads, or any other fields specific to the protocol being used.
Conclusion
Reassembling Wireshark WiFi captured LLC packets into their original messages can provide valuable insights into network communication. By following the steps outlined in this article, you can easily reassemble LLC packets and analyze their contents. Remember to capture enough packets and identify the correct LLC protocol before reassembling the packets.
References
| Number | Source |
|---|---|
| 1 | https://www.wireshark.org/ |
| 2 | https://en.wikipedia.org/wiki/Logical_link_control |