Sniffer® Portable Professional User's Guide - NetScout

More documents

Recommendations

Info

Chapter 4 58 Sniffer Portable Professional Notes on WPA/WPA2 Decryption Sniffer Portable Professional must observe the four EAPOL exchange packets for successful WPA decryption to take place. These packets must be seen for every independent Sniffer Portable Professional session and every independent Client > AP session. Each time you restart the application or use the File > Reset All command, Sniffer Portable Professional will need to see new EAPOL exhange packets for successful decryption. Note the following: EAPOL exchange packets are seen when a client connects to the access point. After starting Sniffer Portable Professional, perform a manual connection to the access point to make sure the EAPOL packets are exchanged. Decrypted WPA/WPA2 packets will only appear in the Expert and Decode displays after the EAPOL exchange packets are seen. EAPOL packets are only valid for a single session of Client > AP communications. Sniffer Portable Professional needs new EAPOL exchange packets for each new session. The EAPOL exchange packets must not have CRC errors in order for decryption to work successfully. If you suspect that decryption is not working correctly, try reconnecting a client to the access point with the specified passphrase. Sniffer Portable Professional installations on Windows XP do not support WPA decryption of traffic seen on Private networks. You can temporarily disable a particular WPA/WPA2 key using the Off/On radio buttons. Specifying WEP Keys Use the WEP Keys options in the IEEE 802.11 Decryption Keys dialog box to specify the keys to be used for decryption of WEP-encrypted packets. You can enter either a Single Key Set for all wireless channels or specify separate keys for individual channels. Keys can be entered as either Hex or ASCII characters. If the correct keys are specified, Sniffer Portable Professional can decrypt and decode WEP-encrypted packets during capture. NOTE: Sniffer Portable Professional can decrypt both WPA/WPA2-encrypted and WEP-encrypted data at the same time, so long as you have enabled and configured both forms of decryption in the IEEE 802.11 Decryption Keys dialog box.
Setting Options in the Sniffer Window NOTE: You can also perform postcapture decryption on trace files saved without the Encryption options specified correctly. See Postcapture 802.11 Decryption on page 199 for information on how to decrypt encrypted data in a buffer or saved trace file. To enter WEP encryption keys: 1 Display the Tools > Wireless > Encryption dialog box. 2 In the WEP Keys area, check the Enable box to turn on decryption of WEP-encrypted packets. 3 Use the Key entry mode options to specify whether Sniffer Portable Professional should use the same WEP keys on every channel on the wireless network or different keys on different channels. Enable the Single Key Set option if you would like Sniffer Portable Professional to use the specified WEP keys for every channel on the wireless network. Enable the Keys Per Channel option if you would like to specify different sets of WEP keys for different topologies and channels on the wireless network. Then, use the Topology, Channel, and Key list to specify separate keys for individual channels. 4 Use the Hex/ASCII radio buttons to specify the format in which you’d like to enter the WEP keys. 5 You can enter up to four separate encryption keys. For each key, do the following: a Specify the length of the key by selecting the appropriate option. Keys can be either None, 40-bit, or 128-bit. Use the None option if no encryption is used on the network. Depending on the length of the key specified, some or all of the adjacent fields become active, enabling you to specify the keys in use. b Specify the exact, case-sensitive value for each key in the adjoining spaces provided. Keep the following in mind when entering keys in ASCII format: An empty field is equivalent to a setting of None in Hex entry mode (that is, no encryption is used on the network). Five ASCII characters or 0x followed by 10 hex characters is interpreted as a 40-bit key. User’s Guide 59
Page 1 and 2:
Sniffer ® Portable Professional Us
Page 3 and 4:
"This product includes software dev
Page 5:
Related Information Resources NetSc
Page 8 and 9: 5 Monitoring Your Network . . . . .
Page 10 and 11: 10 Sniffer Portable Professional
Page 12 and 13: Chapter 1 Product Comparison Table
Page 14 and 15: Chapter 1 Major Components of Sniff
Page 16 and 17: Chapter 1 Table 1-2. Features for W
Page 18 and 19: Chapter 2 System Requirements 18 Sn
Page 20 and 21: Chapter 2 20 Sniffer Portable Profe
Page 22 and 23: Chapter 2 Installing the Sniffer Po
Page 26 and 27: Chapter 2 Native Atheros Driver Upd
Page 30 and 31: Chapter 2 Authorizing Sniffer Porta
Page 32 and 33: Chapter 2 Entering Licensing Inform
Page 34 and 35: Chapter 2 Starting Sniffer Portable
Page 36 and 37: Chapter 2 Tuning Settings for Sniff
Page 42 and 43: Chapter 3 a b c 42 Sniffer Portable
Page 44 and 45: Chapter 3 Sniffer Window Menus 44 S
Page 48 and 49: Chapter 4 Setting the General Tab O
Page 52 and 53: Chapter 4 Setting the App Threshold
Page 54 and 55: Chapter 4 Setting Tools > Wireless
Page 56 and 57: Chapter 4 Configuring Wireless Encr
Page 64 and 65: Chapter 4 Adding Tools to the Tools
Page 68 and 69: Chapter 5 Monitoring Wireless Netwo
Page 70 and 71: Chapter 5 Applying Monitor Filters
Page 72 and 73: Chapter 5 Dashboard 72 Sniffer Port
Page 76 and 77: Chapter 5 The Dashboard Gauge Tab 7
Page 82 and 83: Chapter 5 Host Table 82 Sniffer Por
Page 88 and 89: Chapter 5 Viewing Access Points Onl
Page 92 and 93: Chapter 5 Selecting Wireless Host T
Page 96 and 97: Chapter 5 Setting Capture Filters f
Page 100 and 101: Chapter 5 ART - The Server-Client R
Page 102 and 103: Chapter 5 Show Options 102 Sniffer
Page 104 and 105: Chapter 5 ART Options - Servers Onl
Page 106 and 107: Chapter 5 106 Sniffer Portable Prof
Page 108 and 109:
Chapter 5 Adding Custom Protocols t
Page 110 and 111:
Chapter 5 History Samples Click to
Page 112 and 113:
Chapter 5 112 Sniffer Portable Prof
Page 114 and 115:
Chapter 5 Protocol Distribution 114
Page 116 and 117:
Chapter 5 Global Statistics 116 Sni
Page 118 and 119:
Page 120 and 121:
Chapter 5 Monitor Alarms 120 Sniffe
Page 122 and 123:
Chapter 6 Capture Controls 122 Snif
Page 124 and 125:
Chapter 6 Capture Buffer 124 Sniffe
Page 126 and 127:
Chapter 6 Tips: 126 Sniffer Portabl
Page 128 and 129:
Chapter 6 Capturing from Specific S
Page 130 and 131:
Page 132 and 133:
Page 134 and 135:
Chapter 7 Setting Expert Options 13
Page 136 and 137:
Page 138 and 139:
Chapter 7 Expert Subnet Mask Settin
Page 140 and 141:
Page 142 and 143:
Page 144 and 145:
Chapter 7 Discovered access points
Page 146 and 147:
Page 148 and 149:
Page 150 and 151:
Chapter 7 Expert Oracle Options 150
Page 152 and 153:
Chapter 7 Limitations of the Expert
Page 154 and 155:
Chapter 7 Click to show the packet
Page 156 and 157:
Page 158 and 159:
Chapter 8 Displaying Captured Packe
Page 160 and 161:
Chapter 8 Postcapture Views for Wir
Page 162 and 163:
Page 164 and 165:
Page 166 and 167:
Chapter 8 Table 8-3. Decode Tab Too
Page 168 and 169:
Page 170 and 171:
Chapter 8 b 170 Sniffer Portable Pr
Page 172 and 173:
Chapter 8 a 172 Sniffer Portable Pr
Page 174 and 175:
Page 176 and 177:
Page 178 and 179:
Page 180 and 181:
Chapter 8 Display Setup > Summary D
Page 182 and 183:
Page 184 and 185:
Page 186 and 187:
Chapter 8 Searching for Frames in t
Page 188 and 189:
Chapter 8 Searching for Frames Matc
Page 190 and 191:
Chapter 8 Searching for Frames Matc
Page 192 and 193:
Chapter 8 Searching for Data Patter
Page 194 and 195:
Page 196 and 197:
Chapter 8 Printing Decoded Packets
Page 198 and 199:
Chapter 8 Using Protocol Forcing Yo
Page 200 and 201:
Chapter 8 Sniffer Portable Professi
Page 202 and 203:
Chapter 8 Postcapture Matrix Tab 20
Page 204 and 205:
Chapter 8 More about the Matrix Tra
Page 206 and 207:
Chapter 8 Postcapture Host Table Ta
Page 208 and 209:
Chapter 8 Postcapture Protocol Dist
Page 210 and 211:
Chapter 8 Postcapture Statistics Ta
Page 212 and 213:
Page 214 and 215:
Chapter 9 4 Click OK. 214 Sniffer P
Page 216 and 217:
Page 218 and 219:
Page 220 and 221:
Chapter 10 220 Sniffer Portable Pro
Page 222 and 223:
Chapter 10 Using a Defined Filter U
Page 224 and 225:
Page 226 and 227:
Chapter 10 Drag and drop a symbolic
Page 228 and 229:
Chapter 10 Setting Filter Options i
Page 230 and 231:
Page 232 and 233:
Chapter 10 Add or Edit Pattern Dial
Page 234 and 235:
Page 236 and 237:
Chapter 10 Specify one or more netw
Page 238 and 239:
Page 240 and 241:
Page 242 and 243:
Page 244 and 245:
Page 246 and 247:
Chapter 10 5 Click OK. 246 Sniffer
Page 248 and 249:
Page 250 and 251:
Chapter 11 Description 250 Sniffer
Page 252 and 253:
Chapter 11 Entering Names Manually
Page 254 and 255:
Chapter 11 Click to resolve the Dom
Page 256 and 257:
Page 258 and 259:
Chapter 12 Type of node triggering
Page 260 and 261:
Chapter 12 Setting Alarm Severity L
Page 262 and 263:
Chapter 12 Logging and Severities f
Page 264 and 265:
Chapter 12 Setting Alarm Notificati
Page 266 and 267:
Page 268 and 269:
Page 270 and 271:
Chapter 13 Creating Sniffer Monitor
Page 272 and 273:
Page 274 and 275:
Capture panel, 123 Capture triggers
Page 276 and 277:
zooming, Host Table 111 display tab
Page 278 and 279:
Resolve name on Network address, Re
Page 280:
280 Sniffer Portable Professional
show all

Sniffer® Portable Professional User's Guide - NetScout

Create successful ePaper yourself

Delete template?

Save as template?