Hello Developer team, Greetings, I have some questions that I want answers and need help. Q) What is the  difference in API for MSE 10.x  than the MSE 8.x API.  To understand the differences do we have any documentation on the differences? If they integrate the application with the  MSE  8.0   they want to know how much re-coding if any they will need to make in order to work with the application they create in  8.0. Q)The  3rd party application developers are  try to create  a  map display provided to  the user who come in company premises to  select the open areas they define within a floors like say open-area 1, open-area 2 etc,. Now they want to  find  what API  is available in MSE to pull all the wlan users  from the MSE ,get  their co-ordinate  positions of  all the users and  also  the MAP and the  AP co-ordinates as well. This  will help them to create  boundaries as different  open areas. Q)  They also want  to be  display the  % of utilization  in each areas. What  API or concept do we have that they can leverage  to build this  application    If and how can we define zones? Where does zone information reside? Q) How can they link the cisco MAPs on the  PI or MSE and  link  or tie the co-ordiantes and reference markers  information using any API  with the same MAPs that they have on  their application Map resolution  what are the specific levels of resolution needed. Q)   Is there a mobile library/API that can be used to help plotting points on a map Q) Is any special consideration needed for displaying maps and associated location points on devices of various dimensions (e.g. iPhone, iPad, Laptop) Q) Is the API the only method for integration or do other methods exist (e.g. DB integration, file transfer, etc.). ... View more

    Introduction '802.11 Sniffer Capture Analysis -Wireshark filtering Wireshark Filtering-wlan Objective This document will help you in guiding how to set up the wireshark and analyze the interesting packets using a versatile tool within the wireshark program called the wireshark filters. Prerequisites The wireshark tool in itself will not help us in getting through the troubleshooting unless we have a good knowledge and understanding of the protocol , the topology of the network and which data points to consider taking sniffer traces. This is true for whether its for a wired or for wireless network where we capture the packets over the air before they are put on the network. The stripping of the wireless mac address is done by the by the AP. Why do we need to capture wireless sniffer trace? When we inspect a traffic or data on a wired network using wired sniffer trace and cant find our interesting packets we need to know where is it missing . Our suspicion may get us to verify if it even made it through the first point of the source of origination which being wireless is working fine or not or it being missed over the air. If it did not make it correctly over the air then will obviously be missing or not get translated or sent over over to the wired side by the AP to the DS or distribution system. It then becomes critical for us identify and localize the wireless network issue using wireless sniffer trace. Why do we need to use wireless sniffer capture filter? When it comes to troubleshooting network related issues there are many dependencies and all work in layered model and each layer data depend on its lower layer below it . There are many components or network elements and configuration and proper operation of the devices helps us achieve a smooth running network. When a working network stops functioning a logical approach is required to localize the issue. Once identified still the exact point of failure is difficult to find. Those situations sniffer comes to our aid. Since this troubleshooting process can become so complicated despite using the best approach and having a good understanding and troubleshooting skills. The problem is that if you capture the packets traveling through a network device we may end having huge file and may even end up to 1G if you capture long enough with lot packets details in it. With the such a large amount of overwhelming data it may be very time-consuming to pin point the problem and gets practically a very difficult task almost tending to impossible. Filtering comes to our rescue to help a good troubleshooting engineer to spot the problems quickly by eliminating the unwanted traffic cutting the variables to a few or minimum variables to focus on at one time. This will help in quickly finding whether the interesting traffic is present or absent from the traffic collected. Use of filters then becomes an art and complements the troubleshooters skill greatly It enhances the time to resolution rapidly hence the need to understand how to use the wireshark filtering. - DISPLAY FILTERS – after you capture a lot of information, they help you to visualize only the packets that you are interested in - CAPTURE FILTERS – from the beginning you know what the packet of interest for you and capture only those packets Filters for coloring the packets- this is used as a visual aid to enhance the display filter or capture filter or can be used just without any filter to just classify the many interesting packets as different colors for high level approach. When to use DISPLAY FILTERS and CAPTURE FILTERS? It is recommended to use the Capture filters, when you know what are you looking for and trying to verify that in a running traffic to that event is captured when run that for more than couple of hours in a heavy traffic environment. This will help in keeping the data collected to stay in a reasonable amount in terms of file size. If we are at a point we are not sure what might be causing the issue and is more of a behavioral random nature of problem then run the packet capture for less time within the probable window of problem occurrence pattern, like one or two hours, capture all the traffic and then use Display filters to visualize only the information that you are searching for. Besides the use of above one can see all the capture and use coloring rules to catch the attention of certain type of packets assigned different colors for easy sorting or distinguishing packet flow. How to filter? Lets get a good understanding of the various fields within a typical wireshark sniffer trace. By breaking it down and defining each field. We will be focusing on 3 items which we need to understand to start using Filtering. Capture filter Display Filter Coloring rules Filter Before we delve in to details, here is the example of the sniffer capture window for wireshark, let dissect. MENU BAR This is the called the Menu bar of the wire shark window It contains the following items: File: This menu contains items to open and merge capture files, save / print / export capture files in whole or in part, and to quit from Wireshark. Edit This menu contains items to find a packet, time reference or mark one or more packets, handle configuration profiles, and set your preferences; (cut, copy, and paste are not presently implemented). View This menu controls the display of the captured data, including colorization of packets, zooming the font, showing a packet in a separate window, expanding and collapsing trees in packet details Go This menu contains items to go to a specific packet. Capture This menu allows you to start and stop captures and to edit capture filters Analyze This menu contains items to manipulate display filters, enable or disable the dissection of protocols, configure user specified decodes and follow a TCP stream. Statistics This menu contains items to display various statistic windows, including a summary of the packets that have been captured, display protocol hierarchy statistics and much more. Telephony This menu contains items to display various telephony related statistic windows, including a media analysis, flow diagrams, display protocol hierarchy statistics and much more. Tools This menu contains various tools available in Wireshark, such as creating Firewall ACL Rules. Internals This menu contains items that show information about the internals of Wireshark. Help This menu contains items to help the user, e.g. access to some basic help, manual pages of the various command line tools, online access to some of the webpages, and the usual about dialog. The Main TOOL BAR The main toolbar provides quick access to frequently used items from the menu. This toolbar cannot be customized by the user, but it can be hidden using the View menu, if the space on the screen is needed to show even more packet data. As in the menu, only the items useful in the current program state will be available. The others will be greyed out (e.g. you cannot save a capture file if you haven't loaded one). The "Filter" toolbar The filter toolbar lets you quickly edit and apply display filters Filter: Brings up the filter construction dialog, , “The "Capture Filters" and "Display Filters" dialog boxes”. Filter input the area to enter or edit a display filter string expressions. A syntax check of your filterstring is done while you are typing. The background will turn red if you enter an incomplete or invalid string, and will become green when you enter a valid string. You can click on the pull down arrow to select a previously-entered filter string from a list. The entries in the pull down list will remain available even after a program restart. Note: After you've changed something in this field, don't forget to press the Apply button (or the Enter/Return key), to apply this filter string to the display. This field is also where the current filter in effect is displayed. Expression: The middle button labeled "Add Expression..." opens a dialog box that lets you edit a display filter from a list of protocol fields, described in, “The "Filter Expression" dialog box” Clear Reset the current display filter and clears the edit area. Apply Apply the current value in the edit area as the new display filter. The "Packet List" pane The packet list pane displays all the packets in the current capture file. Each line in the packet list corresponds to one packet in the capture file. If you select a line in this  pane, more details will be displayed in the "Packet Details" and "Packet Bytes" panes. The "Packet Details" pane The packet details pane shows the current packet (selected in the "Packet List" pane) in a more detailed form.   The "Packet Bytes" pane The packet bytes pane shows the data of the current packet (selected in the "Packet List" pane) in a hexdump style. The Statusbar The statusbar displays informational messages. In general, the left side will show context related information, the middle part will show the current number of packets, and the right side will show the selected configuration profile. Drag the handles between the text areas to change the size The initial Statusbar This statusbar is shown while no capture file is loaded, e.g. when Wireshark is started. The context menu (right mouse click) of the tab labels will show a list of all available pages. This can be helpful if the size in the pane is too small for all the tab labels. The Statusbar The status bar displays informational messages. In general, the left side will show context related information, the middle part will show the current number of packets, and the right side will show the selected configuration profile. Drag the handles between the text areas to change the size. The Status bar with a loaded capture file The colorized bullet on the left shows the highest expert info level found in the currently loaded capture file. Hovering the mouse over this icon will show a textual description of the expert info level, and clicking the icon will bring up the Expert Infos dialog box. The left side shows information about the capture file, its name, its size and the elapsed time while it was being captured. The middle part shows the current number of packets in the capture file. The following values are displayed: Packets: the number of captured packets Displayed: the number of packets currently being displayed Marked: the number of marked packets Dropped: the number of dropped packets (only displayed if Wireshark was unable to capture all packets) Ignored: the number of ignored packets (only displayed if packets are ignored) The right side shows the selected configuration profile. Clicking in this part of the statusbar will bring up a menu with all available configuration profiles, and selecting from this list will change the configuration profile. Using Capture filters Click on “CAPTURE” , “INTERFACES” options and choose the Network adapter from drop down menu which will be used to capture running packets in the network on the PC. Click on the “CAPTURE FILTERS” and enter the filter name and Filter string or directly input the filter string you know in the box. Then hit button. Now the wire shark sniffer program captures packets which are of interest to you only among the huge flow of real time packets of all types of protocols . Display Filter Once you have the captured file loaded you now set up filters to display packets you are interested in looking or avoid seeing packets not interested . This can be done by using simple filter expression or a combination of expression using logical operators to form a complex filer string. Click on “ANALYZE” Select “DISPLAY FILTER” . In the example below we are creating a filer to filter out the only the BEACON packets from a 802.11 wireless packet capture trace as seen below In the yellow highlighter.   Similar to the display filter we can find a particular packet by applying filter after clicking “Find packet” Find FILTER button and entering the filter value in the filter box, if you don't know the string then you can dig further by clicking and hit NEW button and naming the filter strings and applying or typing the filter string with in the box. If you don't know the specific filter spring you can form it by choosing the EXPRESSION button which has various protocol option . Select the one you are looking, expand and you will get more options to select from. You will also have a Logical operator box to choose from to use to match to input the value you want to put and apply completing the filter. You can build display filters that compare values using a number of different comparison operators. Using Coloring filter rule A very useful mechanism available in Wireshark is packet colorization. You can set-up Wireshark so that it will colorize packets according to a filter. This allows you to emphasize the packets you are (usually) interested in You can set-up Wireshark so that it will colorize packets according to a filter you choose to create. This allows you to emphasize the packets you are (usually) interested in. In the example below the packets are colorized for Beacons, Acknowledgement, probe Response, Deauthentication based on the filters mentioned below. Click on Select or use this from the main tool bar. This opens the coloring rules and we can add a new coloring filter using or the select the packet or edit the filter string and assign or adjust the color desired.   In the Edit Color dialog box, simply enter a name for the color filter, and enter a filter string in the Filter text field. , “The "Edit Color Filter" dialog box” shows the values beacon and wlan.fc.type_subtype == 8 which means that the name of the color filter is Beacon and the filter will select protocols of type wlan.fc.type_subtype == 8 which is the beacon filter string. Once you have entered these values, you can choose a foreground and background color for packets that match the filter expression. Click on Foreground color... or Background color... to achieve this. A very useful feature is to export or form the coloring filter and save it by exporting the filter to a file “ tac80211color” as seen below this can be imported , you can create multiple coloring rule files in your troubleshooting folder and use it as a template to your convenience every time you troubleshoot. You can think innovatively and tailor make coloring filter template files such as routing, wlan, switching etc. Color filters files and just import them depending on the problem you are troubleshooting very easily. There is a good coloring rules download which you may download and use at https://supportforums.cisco.com/docs/DOC-23792 This is how the final look of the wireshark packets window looks like after color filter file “ tac80211color” is imported and applied. ... View more

    Introduction 802.11 Sniffer Capture Analysis - Management Frames and Open Auth 802.11 – Frames and open authentication Trying to analyze or troubleshoot a wireless LAN, network using 802.11 packet analyzer will require us to have a thorough understanding of different 802.11 frame types as a basis for finding pointers to localize the causes of the problem area in a wlan network . Taking wlan sniffer traces using tools like omnipeek and or wireshark one can monitor the communications between radio network interface cards (NICs) and access points. We will need to comprehend each frame type occurring in the operation of a wireless LAN and solving network problems. In a wlan RF environment the radio transmission conditions can change so dynamically, coordination becomes a large issue in WLANs. Management and control packets are dedicated to these coordination functions. To find cause of the wlan problems occurring in the wlan network relating to RF environment it would be best to test the wlan network using open authentication without any security. By taking this approach the RF connectivity issues surface and can be corrected before we can move to stronger encryption and higher layers of the OSI layer. Authentication in the 802.11 specification is based on authenticating a wireless station or device instead of authenticating a user. As per the 802.11 specification client authentication process consists of the following transactions as mentioned below The Access points continuously sends out Beacon Frames which are picked up by the nearby wlan clients. The client can also broadcast on its own probe request frame on every channel Access points within range respond with a probe response frame The client decides which access point (AP) is the best for access and sends an authentication request The access point will send an authentication reply Upon successful authentication, the client will send an association request frame to the access point The access point will reply with an association response The client is now able to pass traffic to the access point 802.11 Client Authentication Process There are 3 types of frames used in the 802.11 MAC layer 2 communications happening over the air which manages and controls the wireless link. They are Management Frames, Control Frames and Data frames. Let’s take a peek at what those frames consist of in little details to help us in analyze the wlan problems better while working with wlan sniffer traces. Management Frames 802.11 management frames enable stations to establish and maintain communications. Management packets are used to support authentication, association, and synchronization. The following are common 802.11 management frame subtypes: Authentication frame: This is a frame signifying to the network membership within the wlan topology. 802.11 authentications is a process whereby the access point either accepts or rejects the identity of a radio NIC to create resources. Authentication restricts the ability to send and receive on the network. It is the first step for a device attempting to connect to an 802.11 WLAN. The function is handled by an exchange of management packets .Authentication is handled by a request/response exchange of management packets. The number of packets exchanged depends on the authentication method employed. In this document we are focusssing on the simplest open authentication method to simplify our troubleshooting of RF issues. wlan.fc.type_subtype == 0x0b The NIC begins the process by sending an authentication frame containing its identity to the access point. With open system authentication (the default), the radio NIC sends only one authentication frame, and the access point responds with an authentication frame as a response indicating acceptance (or rejection). There is an associated authentication ID associated which is the name under which the current station is authenticated itself on joining the network. Deauthentication frame: This is an announcement packet by a station which sends a deauthentication frame to another station if it wishes to terminate secure communications. It is a one-way communication from the authenticating station (a BSS or functional equivalent), and must be accepted. It takes effect immediately. wlan.fc.type_subtype == 0x0c Association request frame: 802.11 associations enable the access point to allocate resources for and synchronize with a radio NIC. A NIC begins the association process by sending an association request to an access point. This frame carries information about the NIC (e.g., supported data rates) and the SSID of the network it wishes to associate with. After receiving the association request, the access point considers associating with the NIC, and (if accepted) reserves memory space and establishes an association ID for the NIC. Packets can show the current association of the sender. Association and Reassociation are handled by request/response management packets. wlan.fc.type_subtype == 0x0 Association response frame: An access point sends an association response frame containing an acceptance or rejection notice to the radio NIC requesting association and will include the Association ID of the requester. If the access point accepts the radio NIC, the frame includes information regarding the association, such as association ID and supported data rates. If the outcome of the association is positive, the radio NIC can utilize the access point to communicate with other NICs on the network and systems on the distribution (i.e., Ethernet) side of the access point. wlan.fc.type_subtype == 0x01 Reassociation request frame: This frame is similar to a association request but has a different purpose and is mainly useful in client roaming where in If a radio NIC roams away from the currently associated access point and finds another access point having a stronger beacon signal, the radio NIC will send a reassociation frame to the new access point. The new access point then coordinates the forwarding of data frames that may still be in the buffer of the previous access point waiting for transmission to the radio NIC. The sender must already be authenticated in order to gain a successful association. wlan.fc.type_subtype == 0x02 Reassociation response frame: An access point sends a reassociation response frame containing an acceptance or rejection notice to the radio NIC requesting reassociation. Similar to the association process, the frame includes information regarding the association, such as association ID and supported data rates. Disassociation frame: A station sends a disassociation frame to another station if it wishes to terminate the association. For example, a radio NIC that is shut down gracefully can send a disassociation frame to alert the access point that the NIC is powering off. The access point can then relinquish memory allocations and remove the radio NIC from the association table. Disassociation is a simple declaration from either an access point or a device. The filter used to apply and find only the Disassociation packets is “wlan.fc.type_subtype == 0x0a” Beacon frame: The access point periodically sends a beacon frame to announce its presence and relay information, such as timestamp to help synchronize member stations with the BSS, , SSID, and other parameters regarding the access point to radio NICs that are within range. This purpose of this frame is to announce the beginning of a Contention Free period (CF), during which the right to transmit is conferred by the access point by polling. Radio NICs continually scan all 802.11 radio channels and listen to beacons as the basis for choosing which access point is having the best signal and availability to get associate with. The filter used to apply and find only the Beacon packets is “wlan.fc.type_subtype == 0x08” Probe request frame: A station or client becomes active or on a PC when the wlan card it enabled it becomes active sends a probe request frame when it needs to obtain information from another station or access point. For After a radio NIC sends out a probe request to determine which access points are within range. The probe request frame is sent on every channel the client supports in an attempt to find all access points in range that match the SSID and client-requested data rates .Its upto the client to determine which access point to associate to by weighing various factors like supported data rates and access point load to select optimal access point thus moves to the authentication phase of 802.11 network after getting responses from Aps as probe response. This mechanism support also helps in roaming station the ability to move between cells while remaining connected in the search for new access point. The filter used to apply and find only the Probe request packets is “wlan.fc.type_subtype ==0x04” Probe response frame: In response to the probe request, APS with matching criteria will respond with a probe response frame containing synchronization information and access point load and would contain capability information, supported data rates, etc. The filter used to apply and find only the Probe request packets is “wlan.fc.type_subtype ==0x05” Control Frames 802.11 control frames assist in the delivery of data frames between stations. The following are common 802.11 control frame subtypes: Request to Send (RTS) frame: The RTS/CTS function is optional and reduces frame collisions present when hidden stations have associations with the same access point. A station sends a RTS frame to another station as the first phase of a two-way handshake necessary before sending a data frame. wlan.fc.type_subtype == 0x1B   Acknowledgement (ACK) frame: After receiving a data frame, the receiving station will utilize an error checking processes to detect the presence of errors. The receiving station will send an ACK frame to the sending station if no errors are found. If the sending station doesn't receive an ACK after a period of time, the sending station will retransmit the frame. wlan.fc.type_subtype == 0x1D Data Frames These at the frames which come later in the game after the basic wlan communication is already established between the Mobile station and the Access point. We will always reach to this 802.11 data frame for analysis typically to verify and analyze over the air if the protocols and data from higher layers within the frame body is getting through to the wire. These frames transport data packets from higher layers, such as web pages, printer control data, etc., within the body of the frame. wlan.fc.type_subtype == 0x20 On a packet analyzer we observe the contents of the frame body within 802.11 data frames for interesting traffic in question. References www.wildpackets.com/resources/compendium/wireless_lan/wlan_packets http://www.willhackforsushi.com/papers/80211_Pocket_Reference_Guide.pdf https://supportforums.cisco.com/docs/DOC-13664 http://www.cisco.com/warp/public/cc/pd/witc/ao1200ap/prodlit/wswpf_wp.htm#wp39317 http://www.wildpackets.com/resources/compendium/wireless_lan/wlan_packet_types ... View more