crypto flag?

crypto flag?

[Johannes Berg]

Hi,

Just wanted to see what people think ... I frequently find myself with
different pcap files:

 * OTA files: completely encrypted frames
 * locally created files (HW crypto): IV present but frame not encrypted
 * (infrequently, with other HW: files that have protection bit w/o IVs)

wireshark has a setting for this, but I find myself switching it around
all the time.

What would you think about a radiotap flag that tells wireshark what
happened in the packet?

johannes

Re: crypto flag?

[Guy Harris]

On Dec 7, 2011, at 10:50 AM, Johannes Berg wrote:

> What would you think about a radiotap flag that tells wireshark what
> happened in the packet?

Other than saying "that tells the program reading the file what happened in the packet" - this shouldn't be thought of as Wireshark-specific - a flag of that sort makes sense; if there's some information that is necessary or every very helpful when processing a file, and the program that generates the file knows that information, the ideal is to have that information stored in the file somewhere that allows programs reading the file to get it.

Re: crypto flag?

[Johannes Berg]

On Wed, 2011-12-07 at 11:47 -0800, Guy Harris wrote:
> On Dec 7, 2011, at 10:50 AM, Johannes Berg wrote:
> 
> > What would you think about a radiotap flag that tells wireshark what
> > happened in the packet?
> 
> Other than saying "that tells the program reading the file what
> happened in the packet" - this shouldn't be thought of as
> Wireshark-specific - a flag of that sort makes sense; if there's some
> information that is necessary or every very helpful when processing a
> file, and the program that generates the file knows that information,
> the ideal is to have that information stored in the file somewhere
> that allows programs reading the file to get it.

Yes, you're right, it's not wireshark specific. I think that we know
this information when generating, and if not we can leave it out.

I think it'd have to be something like

name: crypto flags
bit number: xxx
structure: u8
unit: bitmap

0x01: IV present
0x02: frame encrypted
...

come to think of it, we could record a bit more info about crypto I
guess, at least in the case where we actually have keys (which happens
if you record on the same machine that is doing something)

I'll think about this a bit more to see if there's something else we can
record.

johannes