Guide to Advanced Wifi Data Capture and Analysis

Have you ever wondered what information is carried by the Wi-Fi signals around us? Those invisible radio waves may contain data streams far more complex than we imagine. Today, we embark on a journey to explore how to capture Wi-Fi data from the air and extract valuable insights—a process that goes beyond technical exploration to reveal the inner workings of wireless communication.

To begin capturing Wi-Fi data, you'll need specialized hardware and software. Among the various options available, we focus on a powerful combination: the Omnipeek USB dongle paired with Omnipeek software. This setup allows your laptop to effortlessly capture nearby Wi-Fi packets.

Before starting, ensure you've installed the correct drivers and verified that Omnipeek recognizes your USB dongle. Administrative privileges on your laptop are essential for the software to function properly.

Once your environment is ready, attempt an initial packet capture. If you see data packets appearing in the capture interface, congratulations—your hardware setup is complete!

For meaningful analysis, we need to focus on specific Wi-Fi communications. In this demonstration, we use the CY8CKIT-062S2-43012 PSoC™ 62S2 Wi-Fi BT Pioneer Kit development platform. Using ModusToolbox's Wi-Fi MQTT Client example code, we successfully connected the board to an iPhone hotspot and observed connection confirmation messages in TeraTerm (our terminal emulator).

While these messages confirm successful connection, we want to examine the actual Wi-Fi packets: What data is being transmitted? How is signal quality? Are there transmission errors? These questions guide our next steps.

Analyzing Wi-Fi communication requires knowing the specific channel (frequency) being used. One straightforward method is connecting your laptop to the same iPhone hotspot (which supports multiple connections) and checking the network connection properties to find the channel information.

With this information (channel 6 in our case), configure Omnipeek to monitor the correct channel in the "New Capture" settings.

To capture the complete connection process including all handshake packets, we employed a technique: First disconnect the development board (by unplugging its USB cable), start Omnipeek's capture, then reconnect the board. This allows Omnipeek to record all packets exchanged during reconnection.

After the board reconnects and we test the connection by pressing its SW2 button twice, we stop the capture and save the packet data—now we have valuable Wi-Fi communication records.

While Omnipeek offers robust analysis features, we demonstrate using the free, open-source Wireshark tool for deeper examination. After installing Wireshark, open the saved capture file to view all recorded packets.

To specifically analyze communication between our development board and iPhone, we need the board's Wi-Fi MAC address (available in TeraTerm's output: C4:AC:59:9C:64:38). In Wireshark, apply this filter:

wlan.ta == c4:ac:59:9c:64:38 || wlan.ra == c4:ac:59:9c:64:38

This displays all packets involving our target device.

Adding eapol to our filter reveals the critical four-way handshake process:

(wlan.ta == c4:ac:59:9c:64:38 || wlan.ra == c4:ac:59:9c:64:38) && eapol

Here we can observe the handshake sequence and identify the iPhone's MAC address (2A:55:20:2A:E7:82 in our case). Note that iPhones may change their MAC address with each hotspot activation, unlike fixed routers.

Wi-Fi data is typically encrypted. Without the security key (SSID and password), some packet contents appear unreadable (shown in red in Wireshark). To decrypt, navigate to Edit > Preferences > Protocols > IEEE 802.11, enable decryption, and enter the correct credentials.

With decryption enabled, we can examine DHCP packets using:

(wlan.ta == c4:ac:59:9c:64:38 || wlan.ra == c4:ac:59:9c:64:38) && dhcp

This reveals the IP address (172.20.10.4) assigned to our development board, matching TeraTerm's output and validating our capture accuracy.

Through this process, we've successfully captured and analyzed Wi-Fi communications—from connection handshakes to encrypted data transmission and IP assignment. This methodology provides a foundation for understanding wireless networks, valuable for security research, performance optimization, and troubleshooting.

Important Notes:

• Verify MAC addresses carefully
• Correct channel selection is crucial for successful capture
• Always ensure proper authorization and compliance with regulations