| 1004 | } |
| 1005 | |
| 1006 | int classifyEAPOLMessage(const wifi_promiscuous_pkt_t *pkt) { |
| 1007 | const uint8_t *payload = pkt->payload; |
| 1008 | int qosOffset = ((payload[0] & 0x0F) == 0x08) ? 2 : 0; |
| 1009 | int keyInfoOffset = 24 + qosOffset + 8 + 4 + 1; |
| 1010 | if (pkt->rx_ctrl.sig_len < keyInfoOffset + 2) return -1; |
| 1011 | uint16_t keyInfo = (payload[keyInfoOffset] << 8) | payload[keyInfoOffset + 1]; |
| 1012 | bool install = keyInfo & (1 << 6); |
| 1013 | bool ack = keyInfo & (1 << 7); |
| 1014 | bool mic = keyInfo & (1 << 8); |
| 1015 | bool secure = keyInfo & (1 << 9); |
| 1016 | if (ack && !mic && !install) return 1; |
| 1017 | if (!ack && mic && !install && !secure) return 2; |
| 1018 | if (ack && mic && install) return 3; |
| 1019 | if (!ack && mic && !install && secure) return 4; |
| 1020 | return -1; |
| 1021 | } |
| 1022 | |
| 1023 | void analyzeClientBehavior(const ProbeRequest &probe) { |
| 1024 | auto it = clientBehaviors.find(probe.fingerprint); |