362 lines
		
	
	
		
			11 KiB
		
	
	
	
		
			Plaintext
		
	
	
	
	
	
			
		
		
	
	
			362 lines
		
	
	
		
			11 KiB
		
	
	
	
		
			Plaintext
		
	
	
	
	
	
| 
 | |
| Terms used by Cisco, CAPWAP, LWAPP and others ...
 | |
| 
 | |
| Slot ID = Radio ID
 | |
| AC = MWAR = WLC 
 | |
| AP = RAD = WTP
 | |
| 
 | |
| 
 | |
| 
 | |
| 
 | |
| 
 | |
| 2. Cisco MWAR Addr
 | |
| 
 | |
|    Address of AC
 | |
| 
 | |
|    0                   1                   2                   3
 | |
|    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 | |
|    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 | |
|    |   MWAR Type   |                  Address                      |
 | |
|    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 | |
|    |                Adress                         |
 | |
|    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 | |
| 
 | |
|    Type: 2 for MWAR Addr
 | |
|    Length:   7
 | |
| 
 | |
|    MWAR Type: 0 SPAM Normal MWAR
 | |
|               1 SPAM Master MWAR
 | |
| 
 | |
|    Address: IPv4 Address of AC
 | |
| 
 | |
|    Usage of this field differs from LWAPP where the MAC address
 | |
|    of AP is stored in the Address field.
 | |
|    (See RFC 5412 - Message type 2: AC Address)
 | |
| 
 | |
| 8. Cisco WTP Radio Configuration
 | |
| 
 | |
|    See RFC 5412 - LWAPP 80211 WTP WLAN Radio Configuration. This Cisco 
 | |
|    CAPWAP element is slightly different from LWAPP.
 | |
| 
 | |
|    0                   1                   2                   3
 | |
|    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 | |
|    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 | |
|    |    Radio ID   |   CFG Type    |        Occupancy Limit        |
 | |
|    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 | |
|    |    CFP Per    |      CFP Maximum Duration     |     BSS ID    |
 | |
|    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 | |
|    |                            BSS ID                             |
 | |
|    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 | |
|    |     BSS ID    |        Beacon Period          |  Country Str1 |
 | |
|    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 | |
|    |          Country Str1         |      Country String 2         |
 | |
|    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 | |
|    | Countr Str2   |    gPeriod    |          Reg(?)               |
 | |
|    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 | |
|    |          Reg(?)               |              ?                |
 | |
|    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 | |
| 
 | |
|    Type: 8 
 | |
|    Length: 28
 | |
| 
 | |
|    Radio ID: An 8-bit value representing the radio to configure.
 | |
| 
 | |
|    Config Type:  
 | |
|            0 = Automatic
 | |
| 
 | |
|    Occupancy Limit:   This attribute indicates the maximum amount of
 | |
|       time, in Time Units (TUs), that a point coordinator MAY control
 | |
|       the usage of the wireless medium without relinquishing control for
 | |
|       long enough to allow at least one instance of Distributed
 | |
|       Coordination Function (DCF) access to the medium.  The default
 | |
|       value of this attribute SHOULD be 100, and the maximum value
 | |
|       SHOULD be 1000.
 | |
| 
 | |
|    CFP Period:   The attribute describes the number of DTIM intervals
 | |
|       between the start of Contention-Free Periods (CFPs).
 | |
| 
 | |
|    CFP Maximum Duration:   The attribute describes the maximum duration
 | |
|       of the CFP in TU that MAY be generated by the Point Coordination
 | |
|       Function (PCF).
 | |
| 
 | |
|    BSSID:   The WLAN Radio's base MAC address.  For WTPs that support
 | |
|       more than a single WLAN, the value of the WLAN Identifier is added
 | |
|       to the last octet of the BSSID.  Therefore, a WTP that supports 16
 | |
|       WLANs MUST have 16 MAC addresses reserved for it, and the last
 | |
|       nibble is used to represent the WLAN ID.
 | |
| 
 | |
|    Beacon Period:   This attribute specifies the number of TUs that a
 | |
|       station uses for scheduling Beacon transmissions.  This value is
 | |
|       transmitted in Beacon and Probe Response frames.
 | |
| 
 | |
|   Country Code:   This attribute identifies the country in which the
 | |
|       station is operating.  The first two octets of this string is the
 | |
|       two-character country code as described in document ISO/IEC 3166-
 | |
|       1.  The third octet MUST be one of the following:
 | |
| 
 | |
|    1. an ASCII space character, if the regulations under which the
 | |
|       station is operating encompass all environments in the country,
 | |
| 
 | |
|    2. an ASCII 'O' character, if the regulations under which the station
 | |
|       is operating are for an outdoor environment only, or
 | |
| 
 | |
| 
 | |
| /*   DTIM Period:   This attribute specifies the number of Beacon
 | |
|       intervals that elapses between transmission of Beacons frames
 | |
|       containing a TIM element whose DTIM Count field is 0.  This value
 | |
|       is transmitted in the DTIM Period field of Beacon frames.
 | |
| */
 | |
|  
 | |
| 
 | |
| 83. Cisco AP IP Address
 | |
|     The IPv4 configuration of the WTP
 | |
|  
 | |
|      0                   1                   2                   3
 | |
|      0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 | |
|    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 | |
|    |                         IP Address                            |
 | |
|    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
 | |
|    |                           Netmask                             |
 | |
|    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
 | |
|    |                       Default Gateway                         |
 | |
|    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
 | |
|    |      Type     |             Reserved ...                      |
 | |
|    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
 | |
|    |    Reserved   |            
 | |
|    +-+-+-+-+-+-+-+-+
 | |
| 
 | |
|    Type: 83
 | |
|    Length: 16
 | |
| 
 | |
|     IP Address: The IP address of AP
 | |
|     Netmask: Netmask 
 | |
|     Default Gateway: default gateway
 | |
|     Type: 
 | |
|        1=Static
 | |
|        0=DHCP  
 | |
|     Reserved: (?)
 | |
| 
 | |
| 
 | |
| 91.  AC Name with Index
 | |
| 
 | |
|    Same as AC Name with Priority, defined in CAPWAP RFC 5415.
 | |
| 
 | |
| 
 | |
|    The AC Name with Priority message element is sent by the AC to the
 | |
|    WTP to configure preferred ACs.  The number of instances of this
 | |
|    message element is equal to the number of ACs configured on the WTP.
 | |
|    The WTP also uses this message element to send its configuration to
 | |
|    the AC.
 | |
| 
 | |
|       0                   1
 | |
|       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
 | |
|      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 | |
|      |   Index     |   AC Name...
 | |
|      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 | |
| 
 | |
|    Type:   91 for AC Name with Index
 | |
| 
 | |
|    Length:   >= 2
 | |
| 
 | |
|    Priority:   A value between 1 and 255 specifying the priority order
 | |
|       of the preferred AC.  For instance, the value of one (1) is used
 | |
|       to set the primary AC, the value of two (2) is used to set the
 | |
|       secondary, etc.
 | |
| 
 | |
| 
 | |
|    AC Name:   A variable-length UTF-8 encoded string [RFC3629]
 | |
|       containing the AC name, whose maximum size MUST NOT exceed 512
 | |
|       bytes.
 | |
| 
 | |
| 
 | |
| 
 | |
| 
 | |
| 126. Cisco AP Regulatory Domain
 | |
| 
 | |
| //bandId[0], regDomainSet[1], regDomainSlotId[0], regDomainCode0:[0], regDomainCode1:[1]
 | |
| 
 | |
|     0                   1                   2                   3
 | |
|     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 | |
|    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 | |
|    |   Band ID    | regDomainSet  | RegDomainSlot | RegDomainCode0 |
 | |
|    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
 | |
|    | RegDomainCode1|
 | |
|    +-+-+-+-+-+-+-+-+
 | |
| 
 | |
|    Type: 126
 | |
|    Length: 5
 | |
| 
 | |
| 
 | |
| 
 | |
| 128. Cisco Reset Button State
 | |
| 
 | |
|    The state of the reset button
 | |
| 
 | |
|     0
 | |
|     0 1 2 3 4 5 6 7
 | |
|    +-+-+-+-+-+-+-+-+
 | |
|    | ResetBtnState | 
 | |
|    +-+-+-+-+-+-+-+-+ 
 | |
| 
 | |
|    Type: 128 for Cisco Rest Button State
 | |
|    Length: 1
 | |
| 
 | |
|    ResetBtnState: 1 = Enabeled
 | |
|                   0 = Disabled (?)
 | |
| 
 | |
| 
 | |
| 151. Cisco AP Time Sync
 | |
|    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 | |
|    |                        Unix timestamp                         |
 | |
|    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
 | |
|    |      Type     |
 | |
|    +-+-+-+-+-+-+-+-+
 | |
| 
 | |
|    Type: 151
 | |
|    
 | |
|    Unix timestamp: Time in seconds since 1.1.1970
 | |
|    Type: Time type
 | |
|          0 = Manual (?)
 | |
| 
 | |
| 169. Cisco AP IP Domain 
 | |
| 
 | |
| 170. Cisco AP IP Name Server
 | |
| 
 | |
| 
 | |
| 207. Cisco Board Data Options
 | |
| 
 | |
|   The Cisco Board Data element is present in Discovery Request and 
 | |
|   Join Request messages sent by the WTP.
 | |
| 
 | |
|     0                   1                   2                   3
 | |
|     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 | |
|    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 | |
|    | ANT Type      | Reserved      | AP Type       | Join Priority |
 | |
|    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
 | |
| 
 | |
|    Type: 207 
 | |
|    Length: 4
 | |
| 
 | |
| 
 | |
| 208. Cisco MWAR Type
 | |
| 
 | |
|     0
 | |
|     0 1 2 3 4 5 6 7
 | |
|    +-+-+-+-+-+-+-+-+
 | |
|    | MWAR Type     | 
 | |
|    +-+-+-+-+-+-+-+-+ 
 | |
| 
 | |
|   MWAR Type:
 | |
|     00 = Normal MWAR
 | |
|     01 = Normal MWAR 
 | |
|     02 = Configured MWAR
 | |
| 
 | |
| 254. Cisco SPAM AP LED Flash Config
 | |
| 
 | |
| 
 | |
| 
 | |
| LWAPP
 | |
| =====
 | |
| In this section Cisco vendor specific message elements used in LWAPP 
 | |
| are listed.
 | |
| 
 | |
| Some of these elements are used  by Cisco in CAPWAP where the
 | |
| vendor specific LWAPP message element is encapsulated in a vendor 
 | |
| specific CAPWAP message element. So in CAPWAP we see headers like 
 | |
| this:
 | |
| 
 | |
| Vendor spec CAPWAP | Vedor spec LWAPP  | Vendor specific LWAPP data
 | |
| 00 40 96 00 00 68  | 00 40 96 00 00 86 | ...
 | |
| 
 | |
| 
 | |
| 
 | |
| 
 | |
| 
 | |
| 20. Cisco AP Username Password
 | |
|     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 | |
|    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 | |
|    |                       Username (33 bytes) ...                         
 | |
|    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
 | |
|                              ... Username                          |
 | |
|    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
 | |
|    |                         Password hash ...                        
 | |
|    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
 | |
| 
 | |
|    
 | |
| 
 | |
|    Username: 
 | |
| 	0-terminated username, the field has to fillid up with zeros.
 | |
| 
 | |
| 
 | |
| 
 | |
| 44. Cisco AP Telnet SSH
 | |
|     0                   1             
 | |
|     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 
 | |
|    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 | |
|    |               |               |  
 | |
|    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 | |
| 
 | |
|    Type: 44
 | |
|    Length: 2
 | |
| 
 | |
| 
 | |
| 
 | |
| 54. AP Mode and Type
 | |
| 
 | |
|    The AP Mode and Type message element is used to configure a WTP to
 | |
|    operate in a specific mode.
 | |
| 
 | |
|     0                   1
 | |
|     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
 | |
|    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 | |
|    |     Mode      |     Type      |
 | |
|    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 | |
| 
 | |
| 
 | |
|    Type:   54 for AP  Mode and Type
 | |
| 
 | |
|    Length:   2
 | |
| 
 | |
|    Mode:   An 8-bit value describing the type of information being sent.
 | |
|       The following values are supported:
 | |
| 
 | |
|       0 -  Split MAC / Local Mode 
 | |
|       1 -  Monitor
 | |
|       2 -  Local MAC / FlexConnect
 | |
|       3 -  Rogue Detector
 | |
|       4 -  Sniffer
 | |
| 
 | |
|    Type: AP Type 
 | |
| 
 | |
|       0 - ?
 | |
| 
 | |
| 
 | |
| 
 | |
| 
 | |
| 73. Cisco Path MTU
 | |
| 
 | |
|     0                   1                   2                   3
 | |
|     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 | |
|    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 | |
|    |         Data length           |            Padding            |
 | |
|    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
 | |
|    |         Padding data ..        
 | |
|    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
 | |
| 
 | |
| Type: 73
 | |
| Length: >=4
 | |
| 
 | |
| 134. Cisco MWAR Hash Value
 | |
|    
 | |
|     0                   1                   2                   3
 | |
|     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 | |
|    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 | |
|    |         Hash ... 
 | |
|    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 
 | |
| 
 | |
|    Hash: ASCII string witch represents in hexadecimal notation 
 | |
|          the SHA1 hash of the device certificate.
 | |
| 
 | |
| 
 | |
| 
 |