You can strip the unwanted headers (ethernet up to UDP) with bittwiste.īittwiste -I tzsp.pcap -O tzsp-stripped.pcap -D 0-4F Since data is on the wired network, it doesn't compromise the system in any way.Is there anyway to convert TZSP to something that Aircrack can use it. Note: Data packets from the secured SSID on the AP (where packet-capture is running) will be captured as an unencrypted packet which gives more flexibility for debugging compared to standalone sniffers. Hence, when packet capturing is required the access point can run at max 15 WLANs otherwise the packet capture command will fail. Capturing is stopped with the completion of TZSP process.Ĭapturing wireless packets on radio involves creating a monitor WLAN and attaching TZSP process to the same (done automatically by packet-capture command). Any such captured frame will be sent to the remote server by the TZSP process. Whenever packet capture command ( wired or wireless) with redirect option is started it starts TZSP process in the system which starts capturing data on the specified interface. In case of wireless packets, TZSP header also contains the radio tap information such as channel, signal strength, and data rate etc.

The payload of such UDP frames contains TZSP header and wired/wireless packet data.

Wired capture can be done on ETH, VLAN and WLAN interfaces.Ī stream of packets is sent to the remote server using TZSP frames which are UDP packets sent on port 37008. Streaming will automatically stop (based on packet-count or duration) or can be stopped manually using ' packet-capture redirect stop' command. For streaming wireless packets, pick up radio of interest and remote server IP as the mandatory parameters (other parameters are optional and are meant for packet filtering and controlling packet count/duration). Redirect option under packet-capture provides the mechanism to stream wired and wireless packets to the remote server.

Wireshark tzsp