WLAN Analysis with Wireshark (Radiotap Header Section, Part 1)

The radiotap header format is a mechanism to supply additional information about frames. A generic radiotap header format should look very similar like the following diagram:

Header Length: The header length, for the same STA MAC may not remain the same, depending upon the destination, as well as the type of 802.11 frames being transmitted. Take the following diagram as an example, frame 1000/1001 are heading to the same destination / same type QoS wireless frame, but, one has header length 44, another one 52.

The item with header length 44 carries the following sub-fields:

On the other hand, header length 52 is embedded with below sub-fields.

If taking a close look, you would realize that frame 1000 has additional sub-fields: VHT information:

The Components of a Good LMS (Part 2)

In last article, the writer believes that"Course Content Creation" and "Learner Profile & Learning Activity Analysis" constitute the two superior elements as the components of a Good LMS. The former item has been described in last article, where the second subject should receive the spotlight here.

Learner Profile: In a Corporate LMS, learner profile definitely can be associated with corporate HR database, including name, date of hire, office contact number, job title, division within an organization's. As of the training center, that should cover other items, such as employers, contact number. The following screen shot comes from https://academy.dlink.com/register_signup.asp, indicating the user information D-Link Academy collects for account application.

"Username" is one of the fields reserved / designed for user to login to system. In some LMS, e-mail ID is commonly being used, where in Moodle, you are given the opportunity to create an unique user name for your personal reference.

In Moodle application, when creating a user account (menu: Site administration  > Users  >  Add a new user), it also offers several authentication methods to accept new user, in addition to the account being manually added. This reserves the possibility that when we need to migrate or database synchronize from other existing database. As such, the Sys Admin does not need to spend additional time and duplicate resources in managing user account generation & validation.

Some of the LMS allows new users to make user application. The workflow to grant user account application should pre-defined and stated in the application page. Some of the LMS do not have 7*24 customer support services, thus, you need to ensure customers are aware of the fact that this type of account application might be processed under reasonable business work schedule.

Learning Activity Analysis: refers to any of the activities or achievements a specific user has been conducting in this LMS. For example, the date/time this user login to this system, the course being attending, course reviewed, similar to the following Moodle GUI.

Other vendor would take this feature to initialize a professional report. The following diagram shows a screen shot from a test case when using Docebo. This customized report is carries the benefits of "User-centered design (UCD)."

There are some of the public LMS also play the role of document (learning content) FTP server. In that type of application, record of any download materials, by which user is also recorded. The writer of this blog would also take this type of reports to (a) understand the region which have more target audience, and (b) communicate with those learners to improved the content being written as well as going to be developed.

Of course, we are able to review individual's other learning activities, such as any webinar being registered, but fail to attend the course, taking a Quiz but unable to meet the requirements of challenges questions, or quick downloading all of the on-line videos without a comfortable schedule to digest the content on line. In the writer's view, Big Data technology should also find out a valuable operation when analyzing learners behavior.

The Components of a Good LMS (Part 1)

It is easy to identify basic components within a Learning Management System (LMS), such as Course Creation (template or standard), Course Quiz / Examination, Learning Feedback (Assessments), Communication process between Instructor / Learners, and many others. All of these are correct answers. However, "Course Content Creation" as well as "Learner Profile & Learning Activity Analysis" constitute the two superior elements in this blog writer's beliefs.

We plan to discuss "Course Content Creation" in this article, where more description on "Learner Profile & Learning Activity Analysis" should be expected in the incoming item.

There are several perspectives from "e-Learning Course Content Creation" point of view:

Learning Content: Identifying and organizing course content (the subject at hand) is the primary thing to think about it. Need analysis, in deed, is the direction of thinking in this element. What do you want to talking about or illustrate in your learning content. What is the knowledge level of your target audience, are they subject-matter expert? Are we presenting our materials in a way logically describe our technical points and remove any of the learning difficulty hidden points?

Upon your budget availability, it is definitely possible that we relay the writing of those learning materials to any 3rd party vendor / company, as those companies are good at logical thinking and material writing. (with easily-digestible material.) When a corporate LMS decides to adapt this methodology, there are some points we need to be very careful. For one, a non-disclosure agreement (NDA) should be communicated and signed by business entities. In addition, if this is product-related hands-on materials, make sure those hardware / software products are timely available to content writers, with the communication among Product Mangers in establishing the mutual consensus on the key points planned to be described in the materials.

To show our respect on intellectual property rights, any of the learning content should prepare internally. When any specific materials are collected from 3rd party vendor, the description of content source is definitely necessary.

Question: nowadays many LMS vendors claim they are able to offer "Gamification" as their application. From the learner perspective, what kind of Gamification you would like to experience?

File Format: Most of the LMS in the market provide a variety of accepted eLearning content technical standards, such as File, Video / Screen recording, xAPI, SCORM, AICC (Aviation Industry Computer-Based Training Committee) and others. That kind of availability should also work with our predefined delivery strategy. If face-to-face instructor-led classroom training is not financially durable, are we able to justify the knowledge digest and receiving via other file format?

The following screen shot is one of the configuration screens in Docebo where you can see available options are displayed.

Some of the LMS products also offer the function of slides converting, among the format of PowerPoint and/or Openoffice files. (This function mostly likely is not available in those open source tools)

Optimal Length of A Training Content: Attention spans are vary, where most people are aware that it is shrinking. Most of the traditional learning material are description-based, in plain English, a large amount of words. One of the strengths inherent in this blog writer is writing Hands-On Guide in long pages, a few hundred to thousand. By collaborating with "Use Case" or "Configuration Scenarios" this type of Hands-on Configuration learning content does get attention. However, if lack of application practice / exercise, the learning effectiveness is not easily to be measured.

If the learning content is video basis, 7 ~ 10 minutes should be a proper suggestions, where dynamic format is also recommended. Some of the managers may suggestion to put short Quiz inside a video, where, if any question is not correctly answered, that video is not suggested to continue broadcasting.

Content Delivery Platform: It depends on the platform or system where your learners are going to read / watch your learning content. As such, make sure proper network throughput / performance is calculated and reserved, when you have a great amount of video content and/or interactive sessions. Any unnecessary video delays has undoubtedly made a bad situation much worse.

Conclusion: The agreement on Course Content Creation standard among your stakeholders should be clearly discussed and then practiced. Some of the classic confrontation during the discussion period is always unavoidable but workable, as long as none of the single party opinion being downplayed.

WLAN Analysis with Wireshark (Frame Section, Part 5)

In each of previously saved Wireshark capture files, identical number of frames and time-span are included. In the column of "No." that should describe total frames being collected, where 106,879 is the case in the following example.

In the second column, that shows the exact time where these frame are collected, July, 18, 2019 was the date of this exercise.

Under the menu of "View > Time Display Format" we can select "Seconds Since Beginning of Capture," it should be 46 (seconds). That means we spent around 46 seconds to collect the packets.

When you take Capture File Properties under the menu of Statistics, the given result should match the statement displayed above.

Under the menu of "View > Time Display Format" we can select "Seconds Since Beginning of Capture," it should be 46 (seconds). That means we spent around 46 seconds to collect the packets.

The column of "Time" is extremely helpful, when we filter certain packets for data analysis. For example, we would like to only watch Beacon Frame, thus, in the filter row, we put "wlan.fc.type_subtype == 0x0008" In the menu, we click "View > Time Display Format" and then select "Seconds Since Previous Displayed Packets"

You should be able to see, less than 0.01 seconds, a beacon frame is flipping around in the air. But, be aware, they are not coming from the same STA, as the source MAC is different.

That should pretty much conclude our discussion on "Frame Section."

WLAN Analysis with Wireshark (Frame Section, Part 4)

According to the below screen shot, frame #12, frame length is equal to 353 bytes. When we take the number of 353 and then multiple by 8, the result turns to 2,824 (bits).

In Wireshark, any specific frame(s) can be noted as "Ignore" packets, where the configuration is able to be made under the menu of "Edit --> Ignore/Unignore Packet." The following screen shot should describe this capability.

When a frame is described as "Ignored," it will be dis-selected, then, no further analysis will be made.

Let's take the following illustration as an example. With the Packet Length under Statistics menu, you should be able to see 106,879 as the total packet counts.

However, we have decided to ignore frame 12-14, as shown here. (An ignored packet will be shown with white background and gray foreground.)

With that, the total packet count should be 106,876 (107,879 - 3 = 106,876), as displayed here.

However, under the menu of "Statistics -> Capture File Properties," as shown here, the total captured / displayed packets should remain the same (106,879, in this example).

LMS Deployment Options

Once you have collected all of the requirements on your Learning Management System (LMS), there are several ways to develop and deploy this application system.

In-house Programming: that means you have your dedicated resources (most from IT Dept.) to develop your application system. To meet the requirements under (extremely) limited budget, "LAMP(LINUX、APACHE、MYSQL、PHP)+PHPMYADMIN" is one of the most common platforms being adapted. The project owners rely heavily upon Responsible Parties' technical skills to develop, custom, and later make any updates in this LMS for business benefits.

There are some instances that we outsource this type of Custom-Built LMS project task to 3rd party vendors. Thar vendor should make dedicated resources to design/develop this application. Once the coding work is done and application is running, then, the internal IT employees should receive the baton in a relay race and continue the work to maintain this system.

Open Source LMS Tools: it is easily to identify available open source LMS in the Internet. As this article is written, in ATutor's web site (https://atutor.github.io/), ATutor 2.2.4 is now available with the updated features of adding course gamification as well new user orientation. At the same time, the web link of Moodle 3.7 release notes (https://docs.moodle.org/dev/Moodle_3.7_release_notes) lists Major Features (among various modules), indicating the latest contribution from open community. Dokeos is another open source LMS tool, where it believes it is a good resource to create training paths for your employees, partners and customers (https://www.dokeos.com/). It (Dokeos) positions itself as an excellent solution for "Training Centers" "Manufacturing" "Life Science" and others.

As far as this type of option is concerned, some company download and install an open source tool in their platform and make it a rum with the provision of service to customers. Most of the popular open source tools should have "Installation Guide" "User Manual" easily to be located in their official web site. However, with the tremendous amount of Internet forums, finding out a specific string or word, in responding to your technical questions, is like seeking needle and thread in the sea.

Open Source Hosting Providers: Another option would be to cooperate with Open Source tool specific Hosting Providers. Take Moodle as an example, Moodle Cloud (https://moodlecloud.com/app/en/), Key to School (https://www.keytoschool.com/moodle-hosting/), and A2 Hosting (https://www.a2hosting.com/moodle-hosting) are only some of the examples easily to be searched. On the other hand, A2Hosting (https://www.a2hosting.com/dokeos-hosting) and ODSOL (http://www.odsol.com/Dokeos-hosting.htm) build their business model on Dokeos. Under such circumstance, Customer Support, System Performance, Scalability, and Stability, and of course, acceptable pricing, should be some criteria to bear in your mind.

Before Choosing a Learning Management System

With the popularity of available Learning Management System platform in the market, selecting a proper Learning Management System (LMS) becomes a more difficult decision to make, comparing to what we had experienced before. However, before taking action in selecting LMS platform, understanding Stakeholders' requirements should be realized, I mean, clearly realized.

Management Team: It is possible that the LMS project owners are surrounding with diverse voices within an enterprise environment, where "politically correct" tends to serve the top guideline. One senior director believes the learning content shall be "product-related" where in-and-out Product GUI familiarity keeps the pritorty role. With that, the exact product configuration and GUI/CLI set up should bear the main role in the content. This is a scenario case where your manager believes the target audience of this LMS is the engineers from the business entities who sell and promote your corporate products. If your product configuration/product portfolio is updated on a continuous basis, LMS is required to manage such dynamic content, on parallel processing.

At the same time, some corporate executives credit "Academy Theory," in each subject domain, as these executives believe this type of content, shown in the LMS, can distinguish one from the other. This is a common opinion being addressed, especially, if your LMS is open to general public, instead of only limiting to internal employees.

HR department: When deploying Corporate LMS Software, we need to ensure any of the learning record (or activity) aligns with an employee's profile. In some of the companies, individual employee's performance review is linking with the records shown in LMS. Timely updated learning record with clear/fair statements should justify its power being embedded within a Corporate LMS Software. 

Corporate IT Dept: LMS usually is another application that being hosted by corporate IT dept. The planned LMS system should also be able to mingle with current IT information structure, without causing unnecessary suffering to each party. In addition, what kind of the system alert mechanism LMS requires, should it (or should it not be) in the same IT policy, as other corporate business applications.

Trainers/Content Creators: What do these people (Trainers/Content Creators) recognize about this change, if we are migrating from one system to a new platform? How we are going to train them to keep abreast with what we call "new technology?" Should they take farewell, what would be a proper replacement strategy LMS project owner shall adapt?

Regulation Compliance: With the recognition of personal data protection, regulation compliance, such as "The General Data Protection Regulation (EU)" and "The Personal Data Protection Act," the LMS System Administrators need to be familiar with the regulation guidelines as well as manage those data with due diligence, as they should be.

System Administrator: If the situation deals with migrating from an existing LMS to a new LMS, then, the system implementations bear the responsibility to migrate existing data into new database platform. Example of this type of data include Learner's profile, learning records, certification status. course attending history, and many others). Two major concerns here: (a) any existing field will/will not be migrating to new system, and why is the decision being basing upon; and (b) how would be the users (learners) in the existing system being notified, and (c) what would be the proper remaining time period for the existing LMS to keep on line?

The writer of this blog once being requested to choose a new LMS platform. The instruction being received is to browse a specific web site, such as "Free LMS Software: What Are The Top Solutions For 2019/2018?" and pick up one LMS platform without any further point of considerations. Should you also have an opportunity to receive this type of inspirational assignment on life, what would you do to empower yourself?

WLAN Analysis with Wireshark (Frame Section, Part 3)

Most of the Wireshark files come with a large number of captured frames. Even though it is organized by the number of frames, by default, it is difficult to locate any single item.

By marking a specific frame, it gives us an easier way to identify that frame in later analysis. The function of "Marking Packets" is under the menu of "Edit." As it is illustrated from below image screen shot, we are able to see the available options of

• Mark/Unmark Packet
• Mark All Displayed
• Unmark All Displayed
• ....

Take Frame 6 as an example, as shown in below diagram, the frame is not marked. (Frame is marked: False)

By clicking the menu to activate the marking function, it (the marked packet) will be shown with black background. In addition, the underneath description is saying "Frame is marked: True"

As you can see, Frame 6 is a Probe Response frame, coming from an Access Point (MAC ended with 0C:67:58) to the destination of a STA (MAC ended with C1:96:C4). Then, we would like to explore our interests in all of the Probe Response frames, with the same source/destination, by making those frames. As shown here in the below diagram (Out of those 5 frames, three are re-transmission frames).

Once your analysis work is done, of course, you can exercise the function of "Unmark All Displayed" (under Edit menu) to reset the mark state of all packets.

WLAN Analysis with Wireshark (Frame Section, Part 2)

This following short article illustrates examples on frame encapsulation type. It starts with a case in wireless, then, covers with other technologies.

Within a Wireshark capture, "Encapsulation type" is one of the sub-fields under the session of Frame. The Wireshark display filter of "Encapsulation type" is frame.encap_type. The link-layer type number is the notation of those items, where default is 1 (Ethernet).

In our Wireless packets collection, the "Encapsulation type" is IEEE 802.11, as displayed below.

Another wireless capture is displayed here, where the link-layer type number is 126.

However, when we turn our attention to LAN in our wired device, it should indicate "Ethernet."

By aligning an example from Wireshark sample packets, the following instance shows some SITA WAN (Societe Internationale de Telecommunications Aeronautiques sample packets (contains X.25, International Passenger Airline Reservation System, Unisys Transmittal System and Frame Relay packets). (https://wiki.wireshark.org/SampleCaptures)

Another example deals with ATM Classical IP packets, where the the link-layer type number is 11.

Learning Course Formats For LMS

Despite the planning and resources spent in building a LMS, the learning materials, or what we call learning content, should play another key role as of the success in your LMS. The content can be in a diverse format, such as written document (with all of the stated description) or audio / video copy of the Instructor-led training session. By utilizing today's computer technology, some of the learning content can even linked to a video in youtube or any other web site.

Building a long length content is definitely possible, depending upon the knowledge level of the content creator. However, in the era of fast food, speed is what we all are looking for. Losing patience in a long length content is a common stereotype example. That is one of the challenges that some content creators were planning to direct translate traditional learning materials into digital content, and later on, they realize that the response from their audience is complete different.

One way to keep your reader interested in your topic is the mix use of learning content format. Sometimes you can rely on word document (of course, Power Point) for all of the learning content, the other time, 5-min video, something like that. Fortunately, most of the leading edge LMS are able to accept various format and allocate in the same platform. The idea here is to use various tools, but convert the learning spirit from traditional class-format into digitized learning environment.

Through the years of Instructor-led training experience, the writer of this blog senses the situation that when reading in the same Power Point content, people tend to interpret new information in a complete different way. Some people may get incorrect direction and then lose in the sea of the entire document. Another people may stick in one of the key words/sentences, then, completely got lost in the remaining learning session. This type of situation is very common. That should explain why most of the digital learning in nowadays stays 5-10 learning session, followed by some interactive sections, such as multiple choice questions or fill in blank questions.

The writer of this blog lives in one of the busiest cities in Asia, taking public transportation serves his daily commute. He always takes his time in observing the behavior of other commuters: spending time concentrating on their mobile device. Gaming App is the most application being used. The interactive motion does maintain individual's attention, at the same time, can we define those Gaming App as a LMS? If so, who is learning? In addition, are we able to transform or standardize our learning content into that "interactive motion format" as to keep our learners focused?

Corporate LMS vs. Academic LMS

As of my first article collects the definition of learning management system (LMS), let's turn our focus to understand the differences between Corporate LMS and Academic LMS.

First thing first, the learning behavior. When we are young, we take all of the orders (or assignments) from our teachers, thus, whatever reading homework is given, we follow the rules. However, as we are getting aged. learning has become a static motion, where we might be very selective in choosing the topics we would like to get involved with. In Corporate LMS, there must be a thread setting ensuring all of the employees are willing to follow the learning map (learning path or process) being designed & developed in Corporate LMS, from HR, most of the time. 

The setting of course timelines should be flexible in Corporate LMS. Most of the employees are having a stress schedule during day time, they may visit the learning system in the evening, or after work. The system 7/24 availability shall be a very common requirements here, especially most of the data are able to transmit via Internet (web applications). However, to ensure the quality that some people access system from remote office, proper network bandwidth and strong system throughput need to be pre-justified.

Content creation is one of the most important components in a LMS. Who is going to be the one creating content? In a Corporate LMS, quite a few people, in different division, are invited into the content creation work. However, at school, most of the work are managed by instructors or teachers. As more people get involved with the content, in Corporate LMS, we shall be aware of the needs to put all of the statements & descriptions in the same format, use the similar tone, and make proper adjustment, due to different knowledge level from reader's perspective. However, in a Academic LMS, most of the instructors and professors are pretty much aware of the knowledge level of his/her students. Nevertheless, the contents in both system shall be updated on a timely basis.

Reporting mechanism. Taking course is one thing, however, attempting to write Quiz or exam is another thing. In Academic LMS, we, as students, follow school instruction to attempt exams. However, as an adult, we might come out with a lot of excuses, not to take exam. What is the motivation in pushing our employees to do so, what is the Pros/Cons (of Quiz session) being designed within a Corporate LMS, salary increase? As the manager of this Corporate LMS, are you sure that those questions are justifiable?

There are plenty of LMS selections in the market nowadays. Some of claim best practices as Corporate LMS and/or Academic LMS. However, you are the one who is going to deploy this system and adapt all of the features for your audience, make sure you fully aware of your (or their) requirements before any actions being taken. The statement of "Bad User Experience is a barrier to learning" should not look strange to you.

WLAN Analysis with Wireshark (Frame Section, Part I)

In a generic 802.11 Wireshark capture, we shall be able to identify the information consisting the following sessions:

• Frame (number)
• Radiotap Header
• 802.11 radio information
• IEEE 802.11 Frame (could be Beacon, Data, Probe Response…)
• IEEE 802.11 Wireless LAN

It should look very similar like the diagram as displayed below.

Under the section of Frame (number), there are also numerous sub-fields displaying the information regarding this specific frame.

For example, the encapsulation type being used is IEEE 802.11, (wireless frame).

Epoch, also known as Unix timestamps, is the number of seconds (not milliseconds!) that have elapsed since January 1, 1970 at 00:00:00 GMT (1970-01-01 00:00:00 GMT). When this article is written, its Epoch time is

This frame is arrived on July 18, 2019 11:40AM Taipei Time, where, of course, we are in Taipei when this exercise was conducted.

Since this is the first packet, as a result, “Time delta from previous captured frame” and “Time delta from previous displayed frame” should be zero.

The frame length and capture length appear to be same in each frame, despite the fact that it should be identical from each other.

Each of the Wireshark capture file may contain frames in different length. In the menu of Statistics --> Packet Lengths, you should be able to recognize the summary of Packet Lengths in this capture file.

They are sorted by different statistic range, as you can you, the largest Packet Length, in below collections, is 1686, which is fallen into the section of "1,280~2,559," a very small percentage of frames being collected out of this capture file.

The protocols indicated in this frame is a WLAN_Radio.

WLAN Analysis with Wireshark (Preface)

As Wireless LAN (WLAN) is getting its popularity, more and more IT engineers are shifting their learning focus from wired network to wireless features.

A regular AP (Access Point) and several STAs are the basic components of WLAN network. In IEEE 802.11 (Wi-Fi) terminology, a station (abbreviated as STA) is a computing device that has the capability to use the 802.11 protocol. In this situation, the IT engineer just needs to connect to that AP, either with console port or web browser into GUI interference, in conducting configuration and troubleshooting.

However, through the deployment of high density APs in a domain, the stated above action appears to be lousy and easily make mistakes. As such, many network device manufacturers would also sell wireless AP controller to handle profile-based configurations and troubleshooting. For example, in D-Link, there are DAP series APs and come up with D-Link Nuclias Connect (DNC) software application to manage those APs.

The WLAN controller format can be very diverse, some of the them are hardware basis, software basis, where cloud-based is another common accepted platform in the latest deployment.

For most of the junior engineers who would like to get involved with Networking technology learning process, they may become frustrated as of the difficulty to do Hands-on practice. Devices in a production environment tend to stay over as they are.

Most of the articles published in the Internet are dealing with (a) description on wireless theories, or (b) vendor-specific command and configurations. We rarely see any specific information or a series of articles to illustrate this concept from user (STA) point of view. This is one of the focus in this blog where the writer would like to focus on. Bring your STA, get some Wireshark connections, let’s go from there. 

Basic LMS Concepts (part I)

According to Wiki (1), a learning management system (LMS) is a software application for the administration, documentation, tracking, reporting, and delivery of educational courses, training programs, or learning and development programs. This statement basically consist the components of a LMS. A LMS can be classified in a software application, or various sources of documents being collected in a dynamic format. The idea is with which, it can assist the learners to be aware of something, or digest the know how into the working environment.

Identifying the target audience is an important step when deploying a LMS. Whom will be taking courses in your LMS, students in University or employees in an enterprise environment? Each one of them, as of their learning behavior and the requirements of learning, the process and the de facto appearance can be different. 

At school, most of the students are following the requirements what the instructors tell them to do so, taking the class note, submitting assignment for grade, taking Quiz to review knowledge. However, in an enterprise environment, employees tend to practice this learning process in an extreme dynamic way. Some of the them may direct jump to Quiz session and claim they finish the course learning as they score in a high mark of the Quiz. Some of the them will take brief review of the learning materials and then justify the knowledge in their own language. As such, making the learning materials in an appealing way serves an important factor to have more people attempt this learning process.

The length of the learning materials might vary. For most of the adult learning, one-half hour is usually the maximum session can be reserved to read such materials. Assuming a person take 45-seconds to review all of the description in one power point slide, ideally, 40-pages. When discussing one topic within that 40-pages, make sure you, as the instructor reserve proper space for “Introduction” and “Summary.” Out of which, no more than 5 key concepts of ideas can be illustrated throughout that learning materials.

Quiz session can be arranged, followed by learning materials. Despite the various available format in Quiz, such as True/False, multiple choice questions, the course instructor should ensure the content inside the Quiz closely match to the statements being addressed in the learning materials. Both higher- and ordinary-level questions should be included. That will attract learner’s attention to continue and then finish Quiz sessions.

Note
(1) https://en.wikipedia.org/wiki/Learning_management_system