Monitor mode broken?

From: Glenn Judd (glennj+_at_cs.cmu.edu)
Date: 2002-08-08 17:26:44 UTC

• Next message: Jouni Malinen: "Re: Fragmentation and Retransmission"
• Previous message: Dvir Oren: "Re: Fragmentation and Retransmission"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
• Mail actions: [ respond to this message ] [ mail a new topic ]

Hi All,

I'm attempting to use monitor mode for a conceptually simple task: listen to _all_ 802.11 frames. I believe I have the driver working "correctly"; unfortunately, the current implementation of monitor mode seems to be unable to listen to all frames. There are several problems:

• The main problem I'm having is that non-broadcast data sent to another host (i.e. the non-monitoring host) doesn't show up. prism2_rx() sees the packet, but for some reason, it believes it has an FCS error. If I enable reception of frames with FCS errors, data is passed through (e.g. to wlansniff), but the data looks like complete garbage. That is, the "frame" doesn't look like it came from the wire, but rather is random garbage from memory (I see things that appear to be from memory).

   (A simple experiment in which I see this is with three    computers in 802.11 ad-hoc mode. Computer 1 pings    computer 2 while computer 3 is in monitor mode. Computer    3 sees the acks from the data packets in addition to    beacon frames, arps, etc., but the data frames are    completely bogus. I should mention that all three    computers are practically touching and the noise is    quite low so there should be no _real_ FCS errors.)

• The next problem I'm seeing is that several frames seem to have bogus sizes (> MAX, but < -14). What's up? I'm guessing this could be the same problem for which the code has a workaround.

So, I'm wondering if, in monitor mode, anyone has been able to listen to unicast data frames where the source & dest were not the monitoring host? I can do this with say tcpdump in regular promiscuous mode, but I need the 802.11 layer information.

I'm using the CVS version from July 30th. I don't think the version is an issue since the problem seems quite fundamental. My card is a DLink DWL-650, and my test network is not using WEP.

(Also, if anyone happen to know of any other card/driver/os/application combination that can give me _all_ 802.11 frames I'd be interested.)

Thanks.

Glenn Judd
glennj+www_at_cs.mcu.edu

• Next message: Jouni Malinen: "Re: Fragmentation and Retransmission"
• Previous message: Dvir Oren: "Re: Fragmentation and Retransmission"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
• Mail actions: [ respond to this message ] [ mail a new topic ]