wiki_wifi_sniffing.md

@@ -87,4 +87,72 @@ phy#0
 *  if you can NOT change the channel - you setup is not correct. 
 *  now you should be able to see WiFi packages in the View like shown in this ![Screenshot](uploads/d63a4d4f0bb20ded39797f30bbc67478/Screenshot_at_2020-08-04_10-32-47.png)
 *  generate PSK from SSIS+passphrase [converter](https://www.wireshark.org/tools/wpa-psk.html)
- 
\ No newline at end of file
+
+
+## procedure of full valid analyze
+
+1) setup both AP on:
+  * same WiFi channel
+  * same bandwidth
+  * same mode (a/b/g/n)
+  * same SSID
+  * same WPA2-PSK
+
+2) setup the Client device: 
+  * same WiFi channel (like both AP)
+  * same bandwidth (like both AP)
+  * same mode (a/b/g/n) (like both AP)
+  * same SSID (like both AP)
+  * same WPA2-PSK (like both AP)
+
+3) setup the Sniffer analyzer:
+  * same WiFi channel (like both AP)
+  * same bandwidth (like both AP)
+  * same mode (a/b/g/n) (like both AP) (if needed throttle mode down!)
+  * setup the PSK in the analyzer tool  (see generate PSK above)
+  * if PSK ist NOT setup correctly you can NOT decode the WiFi packages and see underlay IP data stream
+
+4) setup both variable Attunator:
+  * 0.25 dB per step 
+  * dwell time ~250ms
+  * one with start at 0 and end with 60dB
+  * 2nd with start at 60 and end with 0dB
+  * so setup with ~1dB per second and 60dB which will result in ~1 roam per minute
+  * dont start Attunator now - keep both at 0dB!
+
+5) 
+  * start Sniffer / Analyzer now
+  * analyzer need to catch all 4 way attachment handshake from the Client to one AP
+  * start a iperf receive on a device in AP backend network (`iperf -s -u -i1`)
+
+6) 
+  * start/restart Client now to attache one of the AP
+  * wait until you see any UDP/IP package like
+```
+8845	100.120437221	192.168.222.59	192.168.222.255	UDP	186	5448 → 1027 Len=92
+```
+  * if you dont see this after 3-5min and your Client is conneted and can ping the dest. IP please reconnect client again
+  * it can be easy happen the sniffer/analyzer can NOT catch the PSK handling!
+
+7) 
+  * create data traffic via the WiFi by start a iperf on a device connected to the client (`iperf -c192.168.1.2 -u -b1M -i1 -t900`)
+  * setup the needed Speed you prefere
+
+8) 
+  * start not both Attunator of sweeping
+  * log all traffic in a file
+  * let it run for about 10min - to be able to catch a min. of 10 roaming events
+
+9)
+  * to analyze the roaming time please find in the logfile:
+    * last UDP package to AP1 (via MAC address)
+    * first UDO package to the AP2 after the roam
+    * calculate the time different of both packages
+
+
+
+
+
+
+
+