On Mon, Mar 12, 2018 at 2:05 PM, Matthew Newton <mcn@freeradius.org> wrote:
On Mon, 2018-03-12 at 18:55 +0000, Cappalli, Tim (Aruba Security) wrote:
You'll see the EAP server cert in an over the air packet capture.
Wireshark might show it from the EAPoL frames?
Wireshark and tcpdump both exit as the interface (wlan0) is brought up. Both capture programs start fine with the interface not configured, but when I select an SSID in NetworkManager the capture exits immediately.
You can also extract it from the RADIUS EAP-Message attributes if you've got a capture of the RADIUS packets. I've done it manually, but not sure if there's any utilities which will do it.
I'm having a hard time getting the capture as libpcap seems to not want to transition between an L2 interface and an L2 + L3 interface. ?? Any help is appreciated. Thanks! -m