.

capturing packets from cellphone aircard

<<

rattis

User avatar

Hero Member
Hero Member

Posts: 1172

Joined: Mon Jul 27, 2009 1:25 pm

Post Thu Oct 13, 2011 12:55 pm

capturing packets from cellphone aircard

I did quick scans of the forum and google, but couldn't find what I was looking for, so I thought I'd ask here.

Does anyone know how to capture PPP traffic from a cellphone AirCard Modem?

I'm trying to troubleshoot an issue that someone is having with VPN, and thought a packet capture via Wireshark would be helpful here.

The problem is, the box I'm using to test on has to get it's connection via a USB Aircard from a cell phone provider. WinPcap sees it as PPP traffic on Windows 7 and doesn't capture the data according to there FAQ.
OSWP, Sec+
<<

tturner

User avatar

Sr. Member
Sr. Member

Posts: 435

Joined: Thu Jun 26, 2008 4:50 pm

Post Thu Oct 13, 2011 1:07 pm

Re: capturing packets from cellphone aircard

Did you try Netmon? (i have not, but figured it's worth a shot)

You can always use nm2lp http://www.inguardians.com/tools/ to convert the netmon capture to libpcap format.
Certifications:
CISSP, CISA, GPEN, GWAPT, GAWN, GCIA, GCIH, GSEC, GSSP-JAVA, OPSE, CSWAE, CSTP, VCP

WIP: Vendor WAF stuff

http://sentinel24.com/blog @tonylturner http://bsidesorlando.org
<<

rattis

User avatar

Hero Member
Hero Member

Posts: 1172

Joined: Mon Jul 27, 2009 1:25 pm

Post Thu Oct 13, 2011 2:38 pm

Re: capturing packets from cellphone aircard

tturner: I haven't. My first thought when reading your post what's that. Time to google. :)

A friend of mine in irc suggested looking into usb capture tools too.

I'm not a windows person, if I was in linux, I'd just go with tcpdump and be done with it. ;)
OSWP, Sec+
<<

eth3real

User avatar

Sr. Member
Sr. Member

Posts: 309

Joined: Wed Feb 27, 2008 10:35 am

Location: US

Post Tue Oct 18, 2011 12:38 pm

Re: capturing packets from cellphone aircard

if I was in linux, I'd just go with tcpdump and be done with it.


And they never make Linux drivers! :(
Put that in your pipe and grep it!
<<

rattis

User avatar

Hero Member
Hero Member

Posts: 1172

Joined: Mon Jul 27, 2009 1:25 pm

Post Wed Oct 19, 2011 12:48 am

Re: capturing packets from cellphone aircard

eth3real wrote:
if I was in linux, I'd just go with tcpdump and be done with it.


And they never make Linux drivers! :(


When I looked at connecting my laptops and nokia n800 in the past, it was less an issue with the hardware, and more an issue with the software they use for tracking your traffic usage. I was able to do it between my phone and nokia in the past (different carrier). I could probably find how to do the same with the aircard. But I needed to test out the connection from a windows box. part of it was testing the profile I had.
OSWP, Sec+
<<

sil

User avatar

Hero Member
Hero Member

Posts: 551

Joined: Thu Mar 20, 2008 8:01 am

Location: ::1

Post Thu Oct 20, 2011 9:11 am

Re: capturing packets from cellphone aircard

Chris, in order to understand what you want and where you want it, here is a quickie diagram of a ppp setup:


  Code:
Dead[1] --> Established[2] --> Auth[3] --> NLP(NCP negotiation)[4] --> Open[5] --> Terminated[6]



Most devices will begin between 1 and 3 which cannot be sniffed by outside devices as there is no IP going on yet. In order to see what occurs during the setup, you'd need to be in the path of the cellular and device doing the ppp transaction(s). You mention nokia, you can get a sniffer on that device and do some capturing to see what happens.

Now *after the ppp connection* (between 4 and 6) you would need to be somewhere sniffing either on the ppp device or through some insane port mirroring or other. Otherwise AFTER the fact, you're seeing IP (IPCP or IPE, etc). What you may be able to do is mirror the ppp server where the phone would go through the ppp setup by connecting to you first:


  Code:
Phone[a] --> ppp[b] --> Nix device sniffing[c] --> relay[d] --> real PPP server[e]



In this setup, it would help to sniff on a, c and e. This way you can compare and see who is doing what, where and at which stage. Otherwise the data you may need to see (on the original ASCII diagram) 2,3,4 would never be seen unless you have something to decapsulate the ppp frames.

Anyhow, Nokia has their own packet capture application which should get you to a solid state of understanding what is going on: http://betalabs.nokia.com/apps/nokia-co ... y-analyzer
<<

rattis

User avatar

Hero Member
Hero Member

Posts: 1172

Joined: Mon Jul 27, 2009 1:25 pm

Post Thu Oct 20, 2011 12:01 pm

Re: capturing packets from cellphone aircard

Sil. We got  off in the weeds... My comments about noikas were a rebuttal to eth3real's driver comment.

I was trying to find a way to capture the data in steps 4 - 6, to make sure that there wasn't a problem with the VPN Server (client / server).

Bit of an explanation on the original problem:
I set up a new vpn profile for a customer. but when ever the customer would try to connect he would get an immediate error response saying unknown problem at peer.

I needed to be logged in on my work laptpp, and was using my netbook as a test device using a verizon air card. I was getting the same error as the client when trying to connect. I wanted to see what the traffic looked like, to see if the problem was the pcf file, or on the server side. make sure that things were trying to establish and get a baseline to troubleshoot with to compare my side vs the customer's side.

And it all had to be done through Windows.

In the end, the whole thing ended up being a mess, and we ended up going a slightly different route that's working for now. (Problem on customer's end sending UDP traffic).
Last edited by rattis on Thu Oct 20, 2011 12:03 pm, edited 1 time in total.
OSWP, Sec+
<<

rattis

User avatar

Hero Member
Hero Member

Posts: 1172

Joined: Mon Jul 27, 2009 1:25 pm

Post Thu Oct 20, 2011 12:02 pm

Re: capturing packets from cellphone aircard

thanks for the great writeup sil.
OSWP, Sec+
<<

sil

User avatar

Hero Member
Hero Member

Posts: 551

Joined: Thu Mar 20, 2008 8:01 am

Location: ::1

Post Thu Oct 20, 2011 2:53 pm

Re: capturing packets from cellphone aircard

chrisj wrote:I was trying to find a way to capture the data in steps 4 - 6, to make sure that there wasn't a problem with the VPN Server (client / server).

In the end, the whole thing ended up being a mess, and we ended up going a slightly different route that's working for now. (Problem on customer's end sending UDP traffic).


Unf... VPN diagnosing is a PITA big time. Whenever I have to debug on say Juniper SSGs or better, I always want to pull my hair out since each side of a tunnel usually has to have every parameter EXACT.

You say UDP and in the initial post, I saw PPP,, are you doing L2TP? If so, I hope its L2TP over IPSEC, remember, L2TP doesn't encrypt if you didn't know this already. Reason for me asking is, I have a client in NYC, set up his own "tunnels" using L2TP alone where everything and its mother was sniffable.
<<

rattis

User avatar

Hero Member
Hero Member

Posts: 1172

Joined: Mon Jul 27, 2009 1:25 pm

Post Thu Oct 20, 2011 5:00 pm

Re: capturing packets from cellphone aircard

It's Cisco's VPN Client doing IPSEC over UDP. Usually people connect their "local" LAN. Be it Home or other location, and then "VPN in" for remote access.

In the case of my testing (where this all came from), I was in the offce and the aircard was the only way to simulate a connection while not on the network.
OSWP, Sec+

Return to Other

Who is online

Users browsing this forum: No registered users and 0 guests

.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software