[Tool] tools/process/pcap/Wifipcap (v. 2008-02-01)

top

the initial version.

@MISC{tools-process-pcap-Wifipcap-2008-02-01,
  author = {Jeffrey Pang},
  title = {{CRAWDAD} tool tools/process/pcap/Wifipcap (v. 2008-02-01)}, 
  howpublished = {Downloaded from http://crawdad.cs.dartmouth.edu/tools/process/pcap/Wifipcap},
  month = feb,  
  year = 2008
}
					

A simple C++ wrapper around libpcap that allows applications to
selectively demultiplex 802.11 frames, and the most common layer 2 and
layer 3 protocols contained within them. Basically, the wifipcap
library handles all the parsing of 802.11 frames (and/or layer 2/3
packets) from the pcap file (or stream).

////////////////////////////////////////////////////////////////////////////////
// Mercury and Colyseus Software Distribution
//
// Copyright (C) 2004-2005 Ashwin Bharambe (ashu@cs.cmu.edu)
//               2004-2005 Jeffrey Pang    (jeffpang@cs.cmu.edu)
//                    2004 Mukesh Agrawal  (mukesh@cs.cmu.edu)
//
// This program is free software; you can redistribute it and/or
// modify it under the terms of the GNU General Public License as
// published by the Free Software Foundation; either version 2, or (at
// your option) any later version.
//
// This program is distributed in the hope that it will be useful, but
// WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
// General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// along with this program; if not, write to the Free Software
// Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
// USA
////////////////////////////////////////////////////////////////////////////////

- How to compile wifipcap.

    In Linux:
    Enter this directory and type:

    make

    In Windows:
    Open wifipcap.sln in Visual Studio and build it.
    You will need to have the winpcap include and library files
    in the appropriate search paths.

For an overview see wifipcap.h.

(1) Include the header "wifipcap.h" in your application C++ file(s).

(2) Implement a subclass of WifipcapCallbacks. This class has one
    member function for each type of 802.11 frame and layer 2/3
    packets. Each of these functions will be called as a frame/packet
    is parsed.

(3) Create an instance of Wifipcap with either a pcap trace file or
    a live device to capture packets from.

(4) Call Wifipcap::Run with your instance of WifipcapCallbacks.

(5) Compile your program linking to libpcap and wifipcap.a.

    On Linux:
    g++ -o myprogram myprogram.c /path/to/wifipcap.a -lpcap

    On Windows:
    Link the following libraries:
    wpcap.lib ws2_32.lib WINMM.LIB wifipcap.lib

    Make sure wifipcap.lib is in the library path.

Please see sample.cpp.

Most of the code is derived from tcpdump.

Linux: Requires libpcap >= 0.9.4 on Linux.

Windows: Requires WinPcap >= 4.0.2 and AirPcap for 802.11 capture
See: http://www.cacetech.com/support/downloads.htm

[Author] Jeffrey Pang

top

[Paper] klasnja-wifi-privacy

top

[Paper] pang-fingerprinting

top

The ubiquity of 802.11 devices and networks enables anyone to track our every 
move with alarming ease. Each 802.11 device transmits a globally unique and 
persistent MAC address and thus is trivially identifiable. In response, recent 
research has proposed replacing such identifiers with pseudonyms (i.e., 
temporary, unlinkable names). In this paper, we demonstrate that pseudonyms are 
insufficient to prevent tracking of 802.11 devices because implicit 
identifiers, or identifying characteristics of 802.11 traffic, can identify 
many users with high accuracy. For example, even without unique names and 
addresses, we estimate that an adversary can identify 64% of users with 90% 
accuracy when they spend a day at a busy hot spot. We present an automated 
procedure based on four previously unrecognized implicit identifiers that can 
identify users in three real 802.11 traces even when pseudonyms and encryption 
are employed. We find that the majority of users can be identified using our 
techniques, but our ability to identify users is not uniform; some users are 
not easily identifiable. Nonetheless, we show that even a single implicit 
identifier is sufficient to distinguish many users. Therefore, we argue that 
design considerations beyond eliminating explicit identifiers (i.e., unique 
names and addresses), must be addressed in order to prevent user tracking in 
wireless networks.