Probe Request getting\understanding Information Elements (IEs)

Question

I'm trying to read Information Elements (IEs) from the probe request

can't seem to understand the stracture of it as I undersatnd it size can be 0-2312 bytes

but how do I know how many there are?

I have found that IE1: 1 byte is the "IE ID" 1 byte is the "Length" Length bytes is "Content"

but how many ? is it 6 bytes?

I have this example of full Probe request

40000000 ffffffffffff 0209a0b0e53d ffffffffffff 904a 0000

010802040b0c1216182432043048606c03010c2d1a6f0117ff000000010000000000000000000000000000000000007f080000000000000040bf0c31710003feff0000feff0000dd070050f208001300

15fe909d

If I'm right then the middle line is the IE - but how do I "read" it ?

can someone guide ?

Thanks,

*update

I have this data saved from WiFi sniffing using scappy

40000000ffffffffffffea790e524d0fffffffffffff50d90000010802040b0c1216182432043048606c0301042d1a6f0117ff000000010000000000000000000000000000000000007f080000000000000040bf0c31710003feff0000feff0000dd070050f208001300c88b14ca

I have try to upload it to wireshark "Import as HEX dump" the file is txt

but I get empty

can you help again ?

Thanks ,

Answer 1

802.11 Information Elements are defined in IEEE 802.11 Clause 9.4.2, which you can download from https://ieeexplore.ieee.org/browse/standards/get-program/page/series?id=68 (free after registration):

9.4.2.1 General

Elements are defined to have a common general format consisting of a 1 octet Element ID field, a 1 octet Length field, an optional 1 octet Element ID Extension field, and a variable-length element-specific Information field. Each element is identified by the contents of the Element ID and, when present, Element ID Extension fields as defined in this standard. An Extended Element ID is a combination of an Element ID and an Element ID Extension for those elements that have a defined Element ID Extension. The Length field specifies the number of octets following the Length field. See Figure 9-122. The presence of the Element ID Extension field is determined by the Element ID field.

If you have problems decoding the entire frame it might be helpful to load it into Wireshark or similar - no need to reinvent the wheel.

If you space your hex data and save it to a text file like this

000000 40 00 00 00 ff ff ff ff ff ff ea 79 0e 52 4d 0f ff ff ff ff ff ff 50 d9 00 00 01 08 02 04 0b 0c 12 16 18 24 32 04 30 48 60 6c 03 01 04 2d 1a 6f 01 17 ff 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7f 08 00 00 00 00 00 00 00 40 bf 0c 31 71 00 03 fe ff 00 00 fe ff 00 00 dd 07 00 50 f2 08 00 13 00 c8 8b 14 ca

you can import it as an 802.11 frame in Wireshark (File → Import from Hex Dump → Encapsulation Type: IEEE 802.11 Wireless LAN).