Understanding IEEE 802.11(Wi-Fi) Encryption and Authentication: Write Your Own Custom Packet Sniffer

Introduction

As of 2023, it’s estimated that 42 billion cumulative Wi-Fi enabled devices have been shipped (Wi-Fi® by the Numbers: Technology Momentum in 2023, n.d.). Every new device adds to the increasing wireless attack surface, and it’s important for anyone working in the security software industry to have a basic understanding of how wireless networks encrypt traffic and authenticate users. In this article, we’ll go through the 4 currently supported and ratified security standards for Wi-Fi networks. We’ll also look at the IEEE 802.11 packet and header structure. Then we will look at a C program to write your custom packet sniffer linking with libpcap. We will also look at a real-life packet capture using Wireshark GUI.

Outline:

1. Common encryption and auth supported by IEEE 802.11 standards  <- Theoretical Foundation
2. IEEE 802.11 mac header, frame types, Information elements <- Theoretical Foundation
3. Custom C program linked with libpcap to sniff packets <- Practical Application
4. Wireshark based sniffing of nearby APs <- Practical Application

Common Encryption and Authentication Methods Supported by the Standards

WEP (1997), WPA (2003), WPA2(2004), WPA3 (2018) are the 4 officially ratified IEEE 802.11 security standards by the Wi-Fi Alliance. WPA4 is expected to be rolled out with Wi-Fi 7 but no standard has been formally ratified.