hcxpcaptool: added detection of SONOS and APPLE specific authentication.
SONOS adds a special vendor tag to the authentication sequence, too:
Tagged parameters (8 bytes)
Tag: Vendor Specific: Sonos, Inc.
Tag Number: Vendor Specific (221)
Tag length: 6
OUI: 00:0e:58 (Sonos, Inc.)
Vendor Specific OUI Type: 2
Vendor Specific Data: 020101
APPLE adds a special vendor tag to the authentication sequence, too:
Tagged parameters (13 bytes)
Tag: Vendor Specific: Apple, Inc.
Tag Number: Vendor Specific (221)
Tag length: 11
OUI: 00:17:f2 (Apple, Inc.)
Vendor Specific OUI Type: 10
Vendor Specific Data: 0a00010400000000
From now on, hcxdumptool and hcxpcaptool are able to capture and detect this:
$ hcxpcaptool -V tags.pcap
start reading from tags.pcap
summary:
file name....................: tags.pcap
file type....................: pcap 2.4
network type.................: DLT_IEEE802_11_RADIO (127)
endianess....................: little endian
read errors..................: flawless
packets inside...............: 4
skipped packets..............: 0
packets with FCS.............: 0
authentications (OPEN SYSTEM): 4
authentications (SONOS)......: 1
authentications (APPLE)......: 3
That are really nice fingerprints!
SONOS adds a special vendor tag to the authentication sequence, too:
Tagged parameters (8 bytes)
Tag: Vendor Specific: Sonos, Inc.
Tag Number: Vendor Specific (221)
Tag length: 6
OUI: 00:0e:58 (Sonos, Inc.)
Vendor Specific OUI Type: 2
Vendor Specific Data: 020101
APPLE adds a special vendor tag to the authentication sequence, too:
Tagged parameters (13 bytes)
Tag: Vendor Specific: Apple, Inc.
Tag Number: Vendor Specific (221)
Tag length: 11
OUI: 00:17:f2 (Apple, Inc.)
Vendor Specific OUI Type: 10
Vendor Specific Data: 0a00010400000000
From now on, hcxdumptool and hcxpcaptool are able to capture and detect this:
$ hcxpcaptool -V tags.pcap
start reading from tags.pcap
summary:
file name....................: tags.pcap
file type....................: pcap 2.4
network type.................: DLT_IEEE802_11_RADIO (127)
endianess....................: little endian
read errors..................: flawless
packets inside...............: 4
skipped packets..............: 0
packets with FCS.............: 0
authentications (OPEN SYSTEM): 4
authentications (SONOS)......: 1
authentications (APPLE)......: 3
That are really nice fingerprints!