wpa_supplicant & winpcap & windows 2000

engage engage
Sun Nov 20 17:34:34 PST 2005 

On Sunday 20 November 2005 05:09 pm, Jouni Malinen wrote:
>On Sun, Nov 20, 2005 at 02:20:02PM -0700, engage wrote:
>> IEEE 802.1X RX: version=1 type=3 length=95
>>   EAPOL-Key type=254
>> State: ASSOCIATED -> 4WAY_HANDSHAKE
>> WPA: RX message 1 of 4-Way Handshake from 00:12:17:e2:8d:05 (ver=2)
>> WPA: WPA IE for msg 2/4 - hexdump(len=24): dd 16 00 50 f2 01 01 00 00 50
>> f2 04 01 00 00 50 f2 04 01 00 00 50 f2 02
>> WPA: Renewed SNonce - hexdump(len=32): b3 12 4d c8 43 bb 8b a6 1f 03 5a 7d
>> 09 38 25 1f 5d d4 cb fc 96 f5 45 3b 13 0d 89 0a 1c db ae 32
>> WPA: PMK - hexdump(len=32): [REMOVED]
>> WPA: PTK - hexdump(len=64): [REMOVED]
>> WPA: Sending EAPOL-Key 2/4
>> RX EAPOL from 00:12:17:e2:8d:05
>> Setting authentication timeout: 10 sec 0 usec
>> IEEE 802.1X RX: version=1 type=3 length=121
>>   EAPOL-Key type=254
>
>It looks like the first two messages of WPA 4-Way Handshake are
>correctly received. However, something odd happens with the third
>
>message:
>> WPA: Invalid EAPOL-Key MIC when using TPTK - ignoring TPTK
>> WPA: Could not verify EAPOL-Key MIC - dropping packet
>
>It looks like the AP accepted message 2/4, but then send out message 3/4
>with incorrect MIC. This is quite odd behavior.. What AP (vendor/model)
>are you using?

Linksys WRT54Gv2.2 with firmware v4.20.7, Aug. 18, 2005

>
>> RX EAPOL from 00:12:17:e2:8d:05
>> IEEE 802.1X RX: version=1 type=3 length=119
>>   EAPOL-Key type=254
>> WPA: Invalid EAPOL-Key MIC when using TPTK - ignoring TPTK
>> WPA: Could not verify EAPOL-Key MIC - dropping packet
>
>Interestingly, this frame is two bytes shorter than the previous frame
>even though I would have assumed this to be a retransmitted message
>3/4..
>
>Could you please send me debug log with -dd on the command line so that
>these two frames are included in full in the log? In addition, if you
>happen to have Ethereal installed or can install it easily, it would be
>nice to receive a capture log from the network interface with these
>EAPOL-Key frames.

No, I haven't used ethereal in a long time but I guess now is a good time to 
get re-acquainted with it.

Here's the out with -dd:


Initializing interface '\Device\NPF_{A7D8D996-EB21-4B84-8FF6-F416697D6DF9}' 
conf 'wpa_supplicant.conf' driver 'default' ctrl_interface 'N/A'
Configuration file 'wpa_supplicant.conf' -> 'C:
\MyDownloadFiles\WPA/wpa_supplicant.conf'
Reading configuration file 'C:\MyDownloadFiles\WPA/wpa_supplicant.conf'
ctrl_interface='/var/run/wpa_supplicant'
Line: 6 - start of a new network block
ssid - hexdump_ascii(len=5):
     4b 49 37 52 57                                    $$$$$$$$$$$$$$$           
scan_ssid=1 (0x1)
key_mgmt: 0x2
proto: 0x1
pairwise: 0x10
group: 0x10
PSK (ASCII passphrase) - hexdump_ascii(len=30): [REMOVED]
PSK (from passphrase) - hexdump(len=32): [REMOVED]
Priority group 0
   id=0 ssid='$$$$$$$$$$$$$$$'
Initializing interface (2) 
'\Device\NPF_{A7D8D996-EB21-4B84-8FF6-F416697D6DF9}'
EAPOL: SUPP_PAE entering state DISCONNECTED
EAPOL: KEY_RX entering state NO_KEY_RECEIVE
EAPOL: SUPP_BE entering state INITIALIZE
EAP: EAP entering state DISABLED
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
NDIS: Packet.dll version: 3, 1, 0, 27
NDIS: 2 adapter names found
NDIS: 2 adapter descriptions found
NDIS: 0 - \Device\NPF_GenericDialupAdapter - Generic dialup adapter
NDIS: 1 - \Device\NPF_{A7D8D996-EB21-4B84-8FF6-F416697D6DF9} - NETGEAR WG511 
54 Mbps Wireless PC Card
NDIS: Adapter description prefix 'NETGEAR WG511 54 Mbps Wireless PC Card'
ndis_get_oid: oid=0xd010122 len (512) failed
NDIS: verifying driver WPA capability
NDIS: WPA key management supported
NDIS: WPA-PSK key management supported
NDIS: CCMP encryption supported
NDIS: TKIP encryption supported
NDIS: driver supports WPA
NDIS: driver capabilities: key_mgmt 0x5 enc 0xc auth 0x3
Own MAC address: 00:09:5b:e9:19:ac
wpa_driver_ndis_set_wpa: enabled=1
ndis_get_oid: oid=0xd010101 len (6) failed
ndis_set_oid: oid=0xd01011e len (16) failed
ndis_set_oid: oid=0xd010114 len (4) failed
ndis_get_oid: oid=0xd010101 len (6) failed
ndis_set_oid: oid=0xd01011e len (16) failed
ndis_set_oid: oid=0xd010114 len (4) failed
ndis_get_oid: oid=0xd010101 len (6) failed
ndis_set_oid: oid=0xd01011e len (16) failed
ndis_set_oid: oid=0xd010114 len (4) failed
ndis_get_oid: oid=0xd010101 len (6) failed
ndis_set_oid: oid=0xd01011e len (16) failed
ndis_set_oid: oid=0xd010114 len (4) failed
Setting scan request: 0 sec 100000 usec
Added interface \Device\NPF_{A7D8D996-EB21-4B84-8FF6-F416697D6DF9}
State: DISCONNECTED -> SCANNING
Starting AP scan (specific SSID)
Scan SSID - hexdump_ascii(len=5):
     4b 49 37 52 57                                    $$$$$$$$$$$$$$$           
NDIS: turning radio on before the first scan
ndis_get_oid: oid=0xd010101 len (6) failed
ndis_get_oid: oid=0xd010101 len (6) failed
ndis_get_oid: oid=0xd010101 len (6) failed
Scan timeout - try to get results
Scan results: 2
Selecting BSS from priority group 0
0: 00:12:17:e2:8d:05 ssid='$$$$$$$$$$$$$$$' wpa_ie_len=26 rsn_ie_len=0 
caps=0x10
   selected based on WPA IE
Trying to associate with 00:12:17:e2:8d:05 (SSID='$$$$$$$$$$$$$$$' freq=2462 
MHz)
Cancelling scan request
WPA: clearing own WPA/RSN IE
Automatic auth_alg selection: 0x1
WPA: using IEEE 802.11i/D3.0
WPA: Selected cipher suites: group 16 pairwise 16 key_mgmt 2
WPA: set AP WPA IE - hexdump(len=26): dd 18 00 50 f2 01 01 00 00 50 f2 04 01 
00 00 50 f2 04 01 00 00 50 f2 02 00 00
WPA: clearing AP RSN IE
WPA: using GTK CCMP
WPA: using PTK CCMP
WPA: using KEY_MGMT WPA-PSK
WPA: Set own WPA IE default - hexdump(len=24): dd 16 00 50 f2 01 01 00 00 50 
f2 04 01 00 00 50 f2 04 01 00 00 50 f2 02
No keys have been configured - skip key clearing
State: SCANNING -> ASSOCIATING
ndis_set_oid: oid=0xd010119 len (4) failed
NDIS: Failed to set OID_802_11_PRIVACY_FILTER (1)
Setting authentication timeout: 5 sec 0 usec
EAPOL: External notification - EAP success=0
EAPOL: External notification - EAP fail=0
EAPOL: External notification - portControl=Auto
ndis_get_oid: oid=0xd010101 len (6) failed
RX EAPOL from 00:12:17:e2:8d:05
RX EAPOL - hexdump(len=99): 01 03 00 5f fe 00 8a 00 10 00 00 00 00 00 00 00 00 
58 f3 3f de 75 dc b9 e8 b0 04 3f 8b 78 fe e0 14 90 17 a2 32 fe 2f 90 7f 43 a6 
7f eb 0b 2e 32 7d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00
Setting authentication timeout: 10 sec 0 usec
NDIS: association information - hexdump(len=158): 57 00 00 00 00 00 00 00 00 
00 00 12 17 e2 8d 05 2f 00 00 00 28 00 00 00 07 00 31 04 00 00 03 c0 18 00 00 
00 57 00 00 00 00 05 4b 49 37 52 57 01 04 02 04 0b 16 32 08 0c 12 18 24 30 48 
60 6c dd 16 00 50 f2 01 01 00 00 50 f2 04 01 00 00 50 f2 04 01 00 00 50 f2 02 
01 08 82 84 8b 96 24 b0 48 6c 32 04 8c 12 98 60 dd 06 00 10 18 02 02 04 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
NDIS: ReqFixed=0x0 RespFixed=0x7 off_req=40 off_resp=87 len_req=47 len_resp=24
NDIS: Request IEs - hexdump(len=47): 00 05 4b 49 37 52 57 01 04 02 04 0b 16 32 
08 0c 12 18 24 30 48 60 6c dd 16 00 50 f2 01 01 00 00 50 f2 04 01 00 00 50 f2 
04 01 00 00 50 f2 02
NDIS: Response IEs - hexdump(len=24): 01 08 82 84 8b 96 24 b0 48 6c 32 04 8c 
12 98 60 dd 06 00 10 18 02 02 04
Association info event
req_ies - hexdump(len=47): 00 05 4b 49 37 52 57 01 04 02 04 0b 16 32 08 0c 12 
18 24 30 48 60 6c dd 16 00 50 f2 01 01 00 00 50 f2 04 01 00 00 50 f2 04 01 00 
00 50 f2 02
resp_ies - hexdump(len=24): 01 08 82 84 8b 96 24 b0 48 6c 32 04 8c 12 98 60 dd 
06 00 10 18 02 02 04
WPA: set own WPA/RSN IE - hexdump(len=24): dd 16 00 50 f2 01 01 00 00 50 f2 04 
01 00 00 50 f2 04 01 00 00 50 f2 02
State: ASSOCIATING -> ASSOCIATED
Associated to a new BSS: BSSID=00:12:17:e2:8d:05
No keys have been configured - skip key clearing
Associated with 00:12:17:e2:8d:05
WPA: Association event - clear replay counter
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
EAPOL: External notification - EAP success=0
EAPOL: External notification - portEnabled=1
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: SUPP_BE entering state IDLE
EAP: EAP entering state INITIALIZE
EAP: EAP entering state IDLE
Setting authentication timeout: 10 sec 0 usec
IEEE 802.1X RX: version=1 type=3 length=95
  EAPOL-Key type=254
WPA: RX EAPOL-Key - hexdump(len=99): 01 03 00 5f fe 00 8a 00 10 00 00 00 00 00 
00 00 00 58 f3 3f de 75 dc b9 e8 b0 04 3f 8b 78 fe e0 14 90 17 a2 32 fe 2f 90 
7f 43 a6 7f eb 0b 2e 32 7d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00
State: ASSOCIATED -> 4WAY_HANDSHAKE
WPA: RX message 1 of 4-Way Handshake from 00:12:17:e2:8d:05 (ver=2)
WPA: WPA IE for msg 2/4 - hexdump(len=24): dd 16 00 50 f2 01 01 00 00 50 f2 04 
01 00 00 50 f2 04 01 00 00 50 f2 02
WPA: Renewed SNonce - hexdump(len=32): b3 12 4d c8 43 bb 8b a6 1f 03 5a 7d 09 
38 25 1f 5d d4 cb fc 96 f5 45 3b 13 0d 89 0a 1c db ae 32
WPA: PMK - hexdump(len=32): [REMOVED]
WPA: PTK - hexdump(len=64): [REMOVED]
WPA: Sending EAPOL-Key 2/4
WPA: TX EAPOL-Key - hexdump(len=123): 01 03 00 77 fe 01 0a 00 10 00 00 00 00 
00 00 00 00 b3 12 4d c8 43 bb 8b a6 1f 03 5a 7d 09 38 25 1f 5d d4 cb fc 96 f5 
45 3b 13 0d 89 0a 1c db ae 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 6f 0c e4 a8 29 c6 c2 22 a4 
29 5c e4 9d d9 7c 00 18 dd 16 00 50 f2 01 01 00 00 50 f2 04 01 00 00 50 f2 04 
01 00 00 50 f2 02
RX EAPOL from 00:12:17:e2:8d:05
RX EAPOL - hexdump(len=125): 01 03 00 79 fe 01 ca 00 10 00 00 00 00 00 00 00 
01 58 f3 3f de 75 dc b9 e8 b0 04 3f 8b 78 fe e0 14 90 17 a2 32 fe 2f 90 7f 43 
a6 7f eb 0b 2e 32 7d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 c8 64 94 0e 18 3c c8 45 bc 2d 10 f6 73 
13 8a 96 00 1a dd 18 00 50 f2 01 01 00 00 50 f2 04 01 00 00 50 f2 04 01 00 00 
50 f2 02 00 00
Setting authentication timeout: 10 sec 0 usec
IEEE 802.1X RX: version=1 type=3 length=121
  EAPOL-Key type=254
WPA: RX EAPOL-Key - hexdump(len=125): 01 03 00 79 fe 01 ca 00 10 00 00 00 00 
00 00 00 01 58 f3 3f de 75 dc b9 e8 b0 04 3f 8b 78 fe e0 14 90 17 a2 32 fe 2f 
90 7f 43 a6 7f eb 0b 2e 32 7d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 64 94 0e 18 3c c8 45 bc 2d 
10 f6 73 13 8a 96 00 1a dd 18 00 50 f2 01 01 00 00 50 f2 04 01 00 00 50 f2 04 
01 00 00 50 f2 02 00 00
WPA: Invalid EAPOL-Key MIC when using TPTK - ignoring TPTK
WPA: Could not verify EAPOL-Key MIC - dropping packet
RX EAPOL from 00:12:17:e2:8d:05
RX EAPOL - hexdump(len=123): 01 03 00 77 fe 03 a2 00 10 00 00 00 00 00 00 00 
02 58 f3 3f de 75 dc b9 e8 b0 04 3f 8b 78 fe e0 14 90 17 a2 32 fe 2f 90 7f 43 
a6 7f eb 0b 2e 32 7c 90 17 a2 32 fe 2f 90 7f 43 a6 7f eb 0b 2e 32 7e 72 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 8b 49 d0 64 98 9f 5e 1a 82 59 d9 25 03 
34 c4 9c 00 18 01 3c 1f a6 cf f8 bb ad 7c d7 9e 15 1d 3b 99 72 c9 f2 2f 51 84 
4d c6 80
IEEE 802.1X RX: version=1 type=3 length=119
  EAPOL-Key type=254
WPA: RX EAPOL-Key - hexdump(len=123): 01 03 00 77 fe 03 a2 00 10 00 00 00 00 
00 00 00 02 58 f3 3f de 75 dc b9 e8 b0 04 3f 8b 78 fe e0 14 90 17 a2 32 fe 2f 
90 7f 43 a6 7f eb 0b 2e 32 7c 90 17 a2 32 fe 2f 90 7f 43 a6 7f eb 0b 2e 32 7e 
72 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8b 49 d0 64 98 9f 5e 1a 82 59 
d9 25 03 34 c4 9c 00 18 01 3c 1f a6 cf f8 bb ad 7c d7 9e 15 1d 3b 99 72 c9 f2 
2f 51 84 4d c6 80
WPA: Invalid EAPOL-Key MIC when using TPTK - ignoring TPTK
WPA: Could not verify EAPOL-Key MIC - dropping packet
EAPOL: startWhen --> 0
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: txStart
WPA: drop TX EAPOL in non-IEEE 802.1X mode (type=1 len=0)
Authentication with 00:12:17:e2:8d:05 timed out.
Added BSSID 00:12:17:e2:8d:05 into blacklist
State: 4WAY_HANDSHAKE -> DISCONNECTED
No keys have been configured - skip key clearing
EAPOL: External notification - portEnabled=0
EAPOL: SUPP_PAE entering state DISCONNECTED
EAPOL: SUPP_BE entering state INITIALIZE
EAP: EAP entering state DISABLED
EAPOL: External notification - portValid=0
Setting scan request: 0 sec 0 usec
State: DISCONNECTED -> SCANNING
Starting AP scan (broadcast SSID)
ndis_get_oid: oid=0xd010101 len (6) failed
BSSID 00:12:17:e2:8d:05 blacklist count incremented to 2
State: SCANNING -> DISCONNECTED
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
EAPOL: External notification - EAP success=0
CTRL-EVENT-DISCONNECTED - Disconnect event - remove keys
ndis_get_oid: oid=0xd010101 len (6) failed
ndis_set_oid: oid=0xd01011e len (16) failed
ndis_set_oid: oid=0xd010114 len (4) failed
ndis_get_oid: oid=0xd010101 len (6) failed
ndis_set_oid: oid=0xd01011e len (16) failed
ndis_set_oid: oid=0xd010114 len (4) failed
ndis_get_oid: oid=0xd010101 len (6) failed
ndis_set_oid: oid=0xd01011e len (16) failed
ndis_set_oid: oid=0xd010114 len (4) failed
ndis_get_oid: oid=0xd010101 len (6) failed
ndis_set_oid: oid=0xd01011e len (16) failed
ndis_set_oid: oid=0xd010114 len (4) failed
ndis_set_oid: oid=0xd01011e len (16) failed
ndis_get_oid: oid=0xd010101 len (6) failed
CTRL-EVENT-TERMINATING - signal 2 received
Removing interface \Device\NPF_{A7D8D996-EB21-4B84-8FF6-F416697D6DF9}
State: DISCONNECTED -> DISCONNECTED
No keys have been configured - skip key clearing
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
wpa_driver_ndis_set_wpa: enabled=0
No keys have been configured - skip key clearing
Removed BSSID 00:12:17:e2:8d:05 from blacklist (clear)
Cancelling scan request

More information about the Hostap mailing list