User manual CACE TECHNOLOGIES PILOT V1.0

[. . . ] User's Manual CACE Pilot Page 1 PUBLISHED BY CACE Technologies 1949 5th St. #103 Davis, CA 95616 Copyright © 2008 CACE Technologies. No part of the contents of this manuscript may be reproduced or transmitted in any form or by any means without the written permission of the publisher. Wireshark and the Wireshark icon are registered trademarks of Wireshark Foundation, Inc. [. . . ] Certain parts of the ribbon are disabled by default. This is to be expected, as will be explained below. Note: To close any submenu of the ribbon, such as the Decryption Key Manager or Channel Selector, simply click the button again or somewhere outside of the submenu and it will close. Furthermore, all changes take place immediately hence there is no need for confirmation buttons. Sections are broken down going left to right, top to bottom. CACE Pilot Page 19 Trace Files Pilot can analyze trace files of arbitrary size in the PCAP capture format with the following restrictions: 802. 11 Wireless trace files must have either a RadioTap1 or PPI2 header. All wired trace files must have an Ethernet header. For instance, trace files created through software loopback devices (ex. In most of these instances, the traffic passing through these interfaces will eventually pass through an Ethernet interface. Add Trace File The Add Trace File button adds a trace file to the Files panel for analysis. This operation only adds a reference to the file and is not a copy operation. If the file moves on disk, the reference will be no longer valid. Icon 1 Add Trace File Add Folder The Add Folder button adds a directory of trace files to the Files panel for analysis. The selected folder is scanned for all supported trace files and Pilot will only import applicable files. Similar to the add trace file operation, this operation adds a reference to the folder and relevant files and does not copy anything on disk. Furthermore, this operation is not recursive and does not scan subfolders. Icon 2 Add Trace Folder Clear List The Clear List button clears the list of trace files in the Files panel. Icon 3 Clear List Export The Export section lists the functions that will export data out of Pilot either through Wireshark or a PCAP formatted trace file. Wireshark The Wireshark button sends traffic from the selected device or file to Wireshark. Note that this is a two click operation. The first click opens a submenu with two options: Without Filter The Without Filter menu option sends all traffic from the selected device or trace file to Wireshark. In the case of a device, Wireshark will present, by default, a live scrolling capture. The default behavior can be changed by editing the Wireshark preferences. With Filter The With Filter menu option opens up a filter selection dialog (explained later) to filter the traffic to be sent to Wireshark. 1 2 Submenu 1 Send to Wireshark NetBSD: http://netbsd. gw. com/cgi-bin/man-cgi?ieee80211_radiotap+9+NetBSD-current CACE Technology: http://www. cacetech. com/documents/PPI_Header_format_1. 0. 1. pdf 3 FreeBSD: http://www. freebsd. org/cgi/man. cgi?query=tun&manpath=FreeBSD+7. 0-RELEASE&format=html 4 FreeBSD: http://www. freebsd. org/cgi/man. cgi?query=lo&manpath=FreeBSD+7. 0-RELEASE&format=html 5 FreeBSD: http://www. freebsd. org/cgi/man. cgi?query=ppp&manpath=FreeBSD+7. 0-RELEASE&format=html CACE Pilot Page 20 File The File button sends traffic from the selected device or file to a new trace file. Note that this is a two click operation. The first click opens a submenu with two options: Without Filter The Without Filter button sends all traffic from the selected device or trace file and places it in a trace file of a specified name. With Filter The With Filter button opens up a filter selection dialog (explained later) to filter the traffic to be sent to a new trace file of a specified name. After a trace file is created, it is immediately available under the Files panel of the Device and Files Panel. Submenu 2 Send to File Settings The Settings section contains global settings that are immediately applicable to all open views and their charts. Channel Selector The Channel Selector button opens up a submenu that allows for the management of the set and duration of channels to scan or lock. This interface is a large topic and is explained in its own section later on. Icon 4 Channel Selector Wireless Decryption Key Manager The Wireless Decryption Key Manager button opens a submenu that allows for the management the list of keys to use in order to decode encrypted wireless traffic. [. . . ] Note: Although it ultimately depends on the wireless adapter of the station, it is very probable that this action will temporarily drop the connection between a station and its access point. CACE Pilot Page 75 In Wireshark, the deauthentication frame will look similar to the figure below: Figure 45 Wireshark analyzing a Pilot generated Deauthentication frame CACE Pilot Page 76 Filter Dialog The Filter Editor dialog appears after selecting any option to capture traffic with a filter either to file or in Wireshark. It has the following components: Filter Library Filter Parameters Dialog 2 Filter Editor Filter Library The Filter Library, which is fully expanded in the Appendices, contains a list of pre-packaged and custom filters. Filters can be added and removed with the Add and Remove buttons respectively. Filter Parameters The Filter Parameters section has three elements: Description The name of the filter to be created or modified. Type The language the filter is to be written in. [. . . ]