<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-802.11-frame-captures
description: >-
  Analyze 802.11 wireless frame captures using tshark and Wireshark for forensic investigation, protocol analysis, and wireless attack identification.
domain: cybersecurity
subdomain: wireless-security
tags:
  - 802.11
  - pcap-analysis
  - wireshark
  - tshark
  - wireless-forensics
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1040", "T1557.002"]
  nist-csf: ["DE.AE-2", "DE.AE-3", "RS.AN-1"]
  uuid: 8a664a54-b59a-4ee3-8f14-fc13e158f67e
---

# Analyzing 802.11 Frame Captures

## Overview

802.11 frame capture analysis is fundamental to wireless forensics and security investigations.
This covers frame type identification (management, control, data), protocol dissection with
tshark, Wireshark display filters for wireless analysis, EAPOL handshake extraction,
encrypted traffic analysis, and identification of attack signatures in wireless captures.

Mode: `[MODE: BLUE]` for this technique.

## Prerequisites

| Requirement | Details |
|---|---|
| tshark/Wireshark with 802.11 dissector support | Required |
| Monitor-mode wireless adapter for live capture | Required |
| pcap/pcapng files from wireless capture tools | Required |
| WPA decryption keys (if analyzing encrypted traffic) | Required |
| Radiotap or PPI header support | Required |

## Key Concepts

### 802.11 Frame Types

```
IEEE 802.11 Frame Classification:
├── Management Frames (Type 0)
│   ├── Beacon (Subtype 8) — AP advertisement
│   ├── Probe Request/Response (4/5) — client discovery
│   ├── Authentication (11) — auth exchange
│   ├── Association Request/Response (0/1) — join network
│   ├── Deauthentication (12) — disconnect
│   └── Disassociation (10) — remove association
├── Control Frames (Type 1)
│   ├── ACK (13) — frame acknowledgment
│   ├── RTS/CTS (11/12) — medium reservation
│   └── Block ACK (9) — aggregate acknowledgment
└── Data Frames (Type 2)
    ├── Data (0) — standard data
    ├── QoS Data (8) — quality of service
    └── Null Function (4) — power management
```

### Essential Wireshark/tshark Filters

```bash
# Management frames only
tshark -i wlan0mon -Y "wlan.fc.type == 0"

# Beacon frames for specific SSID
tshark -i wlan0mon -Y 'wlan.fc.type_subtype == 0x08 && wlan.ssid == "TargetSSID"'

# EAPOL frames (WPA handshake)
tshark -i wlan0mon -Y "eapol"

# Data frames from specific client
tshark -i wlan0mon -Y "wlan.fc.type == 2 && wlan.sa == $CLIENT_MAC"

# Retransmissions (performance analysis)
tshark -i wlan0mon -Y "wlan.fc.retry == 1"

# Signal strength below threshold
tshark -i wlan0mon -Y "radiotap.dbm_antsignal < -70"
```

### Handshake Extraction

```bash
# Extract EAPOL handshake from capture
tshark -r capture.pcap -Y "eapol" \
  -T fields -e frame.number -e wlan.sa -e wlan.da -e eapol.type

# Verify complete 4-way handshake
tshark -r capture.pcap -Y "eapol" | wc -l
# Need 4 EAPOL frames between same AP-client pair

# Decrypt WPA2 traffic with known PSK
tshark -r capture.pcap -o "wlan.enable_decryption:TRUE" \
  -o "uat:80211_keys:\"wpa-pwd\",\"password:SSID\""
```

### Attack Pattern Recognition

```bash
# Deauth flood signature
tshark -r capture.pcap -Y "wlan.fc.type_subtype == 0x0c" -q -z io,stat,1

# Probe request flood (device tracking)
tshark -r capture.pcap -Y "wlan.fc.type_subtype == 0x04" \
  -T fields -e wlan.sa | sort | uniq -c | sort -rn

# Fake authentication attempts
tshark -r capture.pcap -Y "wlan.fc.type_subtype == 0x0b && wlan.fixed.status_code != 0"
```

## Workflow

### Step 1: Capture Collection

```bash
sudo airodump-ng -c $CH --bssid $BSSID -w forensic_capture wlan0mon
```

### Step 2: Frame Classification

```bash
tshark -r forensic_capture-01.cap -q -z wlan,stat
```

### Step 3: Extract Key Events

Identify handshakes, deauths, new associations, and anomalous frames.

### Step 4: Timeline Reconstruction

```bash
tshark -r capture.pcap -T fields -e frame.time_relative -e wlan.fc.type_subtype \
  -e wlan.sa -e wlan.da | sort -n
```

### Step 5: Attack Identification

Correlate frame patterns with known wireless attack signatures.

### Step 6: Generate forensic report with timeline, findings, and evidence preservation chain.

## Detection

```yaml
title: 802.11 Frame Captures Detection
id: 713a9e76-d157-48bd-9810-dc578b8d3ee5
status: experimental
description: Detects suspicious activity related to analyzing 802.11 frame captures techniques in wireless security context
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1040
  - attack.t1557.002
  - attack.initial_access
falsepositives:
  - Wireless intrusion detection system performing routine monitoring
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| 802.11 Frame Captures Detection | windows/network_connection | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1040, T1557.002 |

## Verification

- [ ] Capture file integrity verified (hash before/after analysis)
- [ ] All frame types classified and counted
- [ ] EAPOL handshakes identified and extracted
- [ ] Attack patterns searched (deauth flood, probe flood, fake auth)
- [ ] Timeline reconstructed for security events
- [ ] Findings documented with frame numbers and timestamps

## References

- IEEE 802.11-2020 Standard
- Wireshark 802.11 Protocol Reference
- SANS Wireless Forensics Cheat Sheet
- [tshark man page](https://www.wireshark.org/docs/man-pages/tshark.html)
