rsephiroth/zeek-capwap

A Zeek CAPWAP packet analyzer

Zeek CAPWAP packet analyzer

This repository contains a Zeek packet analyzer for the CAPWAP protocol. Mainly focus on data channel (port 5247). It is packed as a Zeek package, which can be easily installed with Zeek Package Manager.

The CAPWAP protocol is defined in the following RFCs:

• CAPWAP: RFC 5415
• CAPWAP IEEE 802.11 binding : RFC 5416

Installation

Prerequisites

Before trying to install the package, make sure you have the following tools installed:

• Zeek
• Zeek Package Manager command zkg

Everything should be installed correctly if you install the latest Zeek version.

Setup

A simple call to make install from the repository's root directory should install the package and run unit tests. You can also use the zkg command directly:

zkg install https://github.com/AmazingPP/zeek-capwap  # to install as super user
zkg --user install https://github.com/AmazingPP/zeek-capwap  # to install in user space

You might have to update the ZEEKPATH and ZEEK_PLUGIN_PATH environmental variables. To see which value they should take, run the following commands:

zkg env         # For the super user
zkg --user env  # For a normal user

To confirm that installation was successful, you can run the following command:

zeek -NN | grep CAPWAP

If the command's output shows something similar to:

[Packet Analyzer] CAPWAP (ANALYZER_CAPWAP)

the package was correctly installed, and you have access to the CAPWAP packet analyzer.

In the case of any installation problems, please check the Zeek Package Manager documentation.

Events

The plugin defines the following events:

• event capwap_packet(outer: connection, inner: pkt_hdr)
  • Generated for any packet encapsulated in a CAPWAP tunnel.

License

This project is licensed under the BSD license. See the LICENSE file for details.

Contributors

• Fupeng Zhao
  • GitHub: @AmazingPP
  • Email: [email protected]