Mobile Packet Sniffer Ofer Borosh Vadim Lanzman Dr. Chen Avin Ben-Gurion University of the Negev Department of Communication Systems Engineering. Mobile Packet Sniffer Presented by: Ofer Borosh Vadim Lanzman Instructor: Dr. Chen Avin

Contents Packet Sniffing Motivation. Project Goal. Android platform. Packet capturing. Monitor mode Problem. ARP injection solution. Learning Process. Follow up. Primitive sniffer

Packet Sniffing Motivation Wi-Fi and Bluetooth networks usage is growing continuously, increasing traffic capacities in the wireless medium. Strong Need for a small and Mobile Sniffing Device. Usage of such sniffing device: Important tool for Wireless network designers. Evaluate network protocols and their performance. Understanding and debugging network problems. Address network security issues.

Project Goal Develop packet sniffer application on a compact mobile platform. Perform capturing of packets traveling in wireless networks. Store captured packets in a DB on the capturing device. Perform basic analysis of Captured data. Support the export of captured data to a PC for further analysis.

Project Goal Sniffing Interfaces: Wi-Fi 802.11 b/g Bluetooth 802.15.1 In the future: 3G, ZigBee, GSM

Android Platform Hardware: Qualcomm processor : 528 MHz TI Wi-Fi and Bluetooth integrated chip: WiLink 4.0 TI Wi-Fi driver : WL 1251 GPS ADP G 1 Software: Android Open Source Linux based OS. JAVA SDK 1.6 for Android NDK – for cross compile C files

Normal Packet Decapsulation Packet capturing Normal Packet Decapsulation Packets loose all their headers on the way to the APP layer. We a way to BYPASS the stack. APP. Application Data DATA TRANSPORT TCP/UDP Segment TCP/UDP header DATA NETWORK IP datagram IP header TCP/UDP header DATA LINK Network Frame Ethernet header IP header TCP/UDP header DATA Ethernet trailer PHY

Packet capturing Using RAW Sockets SW Implementations to bypass the stack: Raw Sockets. Tcpdump based on open source Libpcap library. Parsing and analyzing Raw packet headers. Using RAW Sockets APP. OPEN RAW SOCKET TRANSPORT NETWORK LINK Network Frame Using the same method we can inject custom made packets. Ethernet header IP header TCP/UDP header DATA Ethernet trailer PHY

Application Demo 1

Monitor Mode Problem Wi-Fi Element Operational Modes: Ideal sniffer: Master mode. Managed mode. AD-HOC mode. Promiscuous mode. Monitor Mode. WiFi card Driver LINK NETWORK TRANSPORT APP. Ethernet header IP header TCP/UDP header DATA Ethernet trailer 802.11 header Ideal sniffer: Uses Promiscuous or Monitor mode. Problem: TI Driver Prevents the Monitor and Promiscuous modes.

ARP Injection Solution We will use Arp Protocol Properties to solve the problem. Arp Protocol Basics: Arp table in every PC. Need to know the MAC address before sending the packet. Host A Arp Request (Who has IP B ? Broadcast) Host B Arp Reply( Unicast IP B is at MAC B)

ARP Injection Solution We will use Arp Protocol Properties to solve the problem. Switched network properties: Constantly Learning MAC addresses. Prevent the sniffing of neighboring traffic. MAC - A 5 MAC address port MAC - A 5 1 2 3 4 MAC - B 4 MAC - B

ARP Injection Solution Host A ARP cache Host B ARP cache MAC address IP add MAC address IP add MAC - B IP - B MAC - A IP - A Normal traffic 2 3 AP route table MAC address Port 1 MAC - A 2 MAC - B 3 Active Sniffer: IP - C MAC - C

ARP Injection Solution Host A ARP cache Host B ARP cache MAC address IP add MAC address IP add MAC - B IP - B MAC - A IP - A MAC - C MAC - C Arp Injection process 2 3 AP route table 1 MAC address Port MAC - A 2 Active Sniffer: IP - C MAC - C MAC - B 3 MAC - C 1

ARP Injection Solution Host A ARP cache Host B ARP cache MAC address IP add MAC address IP add MAC - C IP - B MAC - C IP - A Re-Routed Traffic 2 3 AP route table 1 MAC address Port MAC - A 2 Active Sniffer: IP - C MAC - C MAC - B 3 MAC - C 1

Active Sniffing Milestones Domain Scanning to find Active Sniffing targets. Arp Packet Injection to the selected targets. Enabling Traffic Rerouting to Avoid denial of service. Capture and analyze the traffic.

Application Demo 2

Learning process Development in JAVA under Android API. Working and Cross Compiling for Linux based OS. Understanding of 802.11 protocol and it’s operational modes. Raw sockets usage. Custom Packet creation and injection ARP spoofing .

Follow Up Extending the Capture interfaces to sniff ZigBee sensors. Building custom parsing engines using Raw sockets. Rewriting the driver to support Monitor mode. End much more…

Questions…?