1

I am trying to integrate WPA2 into open network in AP side, and I managed through quite good so far, I am now able to encrypt and decrypt live traffic.

However, stations are ignoring my messages, specifically ARP response (as it is the first message to occur and nothing will work without it.). MIC in the secured frame is correct, sequence number and IV are incremented.

I was looking for any kind of log files that would shed some light why are my frames discarded - the very next frame I receive from STA has SN and IV same as mine, thus they ignored my message.

I have looked into /var/log/syslog and /var/log/kern.log and journalctl -u NetworkManager, but the information there is not sufficient. I increased logging level to debug by echo "3" > /proc/sys/kernel/printk and nmcli general logging level DEBUG.

What I am looking for is kind of output wpa_supplicant provides in -dd mode. It was very helpful to see exactly what steps are taken by the station, like extracting keys, computing values, checking attributes and so on - basically what is the reason station stops processing the frame. But wpa_supplicant only provides logging until successfully connected - till group handshake; any WiFi frames received afterwards are not processed.

Is there any tool or way on how to get this kind of deep logging in WPA2 station that would show me how it exactly handles received frames?

  • Maybe what you looking for airmon-ng in combination with tcpdump . – gripen fighter Apr 16 at 3:22
  • Thank you for pointing this out, indeed it helped. I needed to have interface in managed mode, as I was attempting to connect from that machine; and monitoring was already in place at another machine. I was (mistakenly) sure that my frames are being dropped so I didn't even think of tcpdump. However, I learnt that MAC is indeed saved in arp cache, thus frame is accepted; just the station does not increment IV. – MMMaroko Apr 16 at 17:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.