Seeking guidance for users that want to analyze 802.11

[philrz]

A Brim user opened an issue that boils down to a desire to see Zeek logs resulting from analyzing a pcap containing 802.11-encapsulated traffic. As is sometimes the case, this user in particular seemed unaware of the role that Zeek plays in generating the logs from pcaps in Brim, so I'm just attempting to point them in the right direction Zeek-wise.

I know I've been seeing Zeek team activity for some time about building in the plumbing to make this kind of thing possible, and the most recent update I found that seems to describe where things stand is the comment from @timwoj at #248 (comment). This is to say, like you guys, the Brim team doesn't really have the cycles to be writing 802.11 parsers, but I'm more than happy to point interested users at relevant Zeek resources so they could implement the parsing for their benefit and that of the community.

My two questions:

1. Is that comment indeed the best reflection of the current state of things, i.e. it's not likely the parsing they seek already exists somewhere and I've just not found it?

2. Can anyone suggest pointers to the best doc/example resources I could pass along so they could make use of the new framework to attempt this parsing?

Thanks!

[timwoj]

The packet analysis framework was added as part of 4.0, which allows us to build analyzers for things lower than the IP layer now. It should be fairly simple to implement an 802.11 that either chains into the existing analyzer tree or does its own logging of some sort.

The documentation for packet analysis can be found at https://docs.zeek.org/en/current/frameworks/packet-analysis.html. There's a sample in the documentation, but we have already implemented a number of packet analyzers under the src/packet_analysis directory in the Zeek repo.

I'm gonna close this out as it's not really a bug or feature request, but feel free to ping me on Slack or the mailing list if you have other questions.

[philrz]

Thanks @timwoj! That's exactly the guidance I was seeking. Will pass it along. 👍