> For the complete documentation index, see [llms.txt](https://hacktricks.xsx.tw/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacktricks.xsx.tw/generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/wifi-pcap-analysis.md).
# Wifi Pcap Analysis
从零开始学习AWS黑客技术，成为专家 htARTE（HackTricks AWS Red Team Expert）！
其他支持HackTricks的方式：
* 如果您想看到您的**公司在HackTricks中做广告**或**下载PDF格式的HackTricks**，请查看[**订阅计划**](https://github.com/sponsors/carlospolop)!
* 获取[**官方PEASS & HackTricks周边产品**](https://peass.creator-spring.com)
* 探索[**PEASS家族**](https://opensea.io/collection/the-peass-family)，我们的独家[**NFTs**](https://opensea.io/collection/the-peass-family)
* **加入** 💬 [**Discord群**](https://discord.gg/hRep4RUj7f) 或 [**电报群**](https://t.me/peass) 或 **关注**我们的**Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**。**
* 通过向[**HackTricks**](https://github.com/carlospolop/hacktricks)和[**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github仓库提交PR来分享您的黑客技巧。
## 检查BSSID
当您收到一个主要流量为Wifi的捕获时，您可以使用WireShark开始调查捕获中的所有SSID，方法是\_Wireless --> WLAN Traffic\_：
### 暴力破解
该屏幕的一列指示**在pcap中是否找到任何身份验证**。如果是这种情况，您可以尝试使用`aircrack-ng`进行暴力破解：
```bash
aircrack-ng -w pwds-file.txt -b file.pcap
```
## 数据在信标/侧通道中
如果您怀疑**数据正在Wifi网络的信标中泄漏**，您可以使用类似以下过滤器来检查网络的信标：`wlan contains `，或者 `wlan.ssid == "NAMEofNETWORK"`，在过滤后的数据包中搜索可疑字符串。
## 在Wifi网络中查找未知MAC地址
以下链接将有助于找到**在Wifi网络中发送数据的设备**：
* `((wlan.ta == e8:de:27:16:70:c9) && !(wlan.fc == 0x8000)) && !(wlan.fc.type_subtype == 0x0005) && !(wlan.fc.type_subtype ==0x0004) && !(wlan.addr==ff:ff:ff:ff:ff:ff) && wlan.fc.type==2`
如果您已经知道**MAC地址，您可以从输出中删除它们**，添加类似这样的检查：`&& !(wlan.addr==5c:51:88:31:a0:3b)`
一旦您发现**在网络中通信的未知MAC地址**，您可以使用类似以下的**过滤器**：`wlan.addr== && (ftp || http || ssh || telnet)` 来过滤其流量。请注意，如果您已解密流量，ftp/http/ssh/telnet过滤器将非常有用。
## 解密流量
编辑 --> 首选项 --> 协议 --> IEEE 802.11--> 编辑
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacktricks.xsx.tw/generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/wifi-pcap-analysis.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.