<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-2">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<div style="color:black; font-size:12pt; font-family:Calibri,Arial,Helvetica,sans-serif">
hi Karel</div>
<div style="color:black; font-size:12pt; font-family:Calibri,Arial,Helvetica,sans-serif">
<br>
</div>
<div style="color:black; font-size:12pt; font-family:Calibri,Arial,Helvetica,sans-serif">
The ethertype in an EAPOL frame should be 0x888e (<a href="https://www.vocal.com/secure-communication/eapol-extensible-authentication-protocol-over-lan/" target="_blank" rel="noopener noreferrer">https://www.vocal.com/secure-communication/eapol-extensible-authentication-protocol-over-lan/</a>).<br>
</div>
<div style="color:black; font-size:12pt; font-family:Calibri,Arial,Helvetica,sans-serif">
<br>
</div>
<div style="color:black; font-size:12pt; font-family:Calibri,Arial,Helvetica,sans-serif">
In a pcap file it would be possible to distinguish EAPOL frames from other frames.</div>
<div style="color:black; font-size:12pt; font-family:Calibri,Arial,Helvetica,sans-serif">
<br>
</div>
<div style="color:black; font-size:12pt; font-family:Calibri,Arial,Helvetica,sans-serif">
I'm not sure if zeek will process EAPOL frames (however, I'm not an expert on this matter). In the past I had to modify the source code in order to process frames that weren't IPv4, IPv6 or ARP ethertypes.<br>
</div>
<div style="color:black; font-size:12pt; font-family:Calibri,Arial,Helvetica,sans-serif">
<br>
</div>
<div style="color:black; font-size:12pt; font-family:Calibri,Arial,Helvetica,sans-serif">
Martin</div>
<br>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> zeek-bounces@zeek.org <zeek-bounces@zeek.org> on behalf of Karel Kuchař <karel.kuchar@dardas.cz><br>
<b>Sent:</b> Thursday, February 27, 2020 10:24 AM<br>
<b>To:</b> zeek@zeek.org <zeek@zeek.org><br>
<b>Subject:</b> [Zeek] 802.11 frames</font>
<div> </div>
</div>
<style type="text/css" style="display:none">
<!--
p
{margin-top:0;
margin-bottom:0}
-->
</style>
<div dir="ltr">
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Dear Zeek Community, <br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
I'm new to zeek but now I'm working on project and I need to solve problem with anomaly detection on Wi-Fi. Is there any possibility how to detect frames specific for 802.11 like EAPOL frame?<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div>
<div style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
<div style="margin-top:0px; margin-bottom:0px">Thanks in advance,<br>
</div>
<p style="margin-top:0px; margin-bottom:0px">Karel K.</p>
</div>
</div>
<br>
</div>
</body>
</html>