Search Linux Wireless

Re: Filtering in Monitor Mode (was Question about PRISM2 header rate field)

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Johannes Berg wrote:
On Sun, 2007-03-04 at 22:10 -0500, Michael Wu wrote:
Note that modifying the management interface to do this is possible, but it would break hostap (and probably wpa_supplicant w/ MLME). Doing packet injection on monitor interfaces instead is safer in that regard.

But if you want to do injection over monitor interfaces we'll need to
have the stupid mgmt interface hack around forever for the userspace
MLME so it can receive only management traffic (even the non-promisc
monitor iface we should have gets *far* too much traffic for a userspace
MLME)

I used the libpcap filter stuff to limit what I saw to just the packets of interest. This is the filtering that tcpdump uses to do the conditional filters like "port 22" or "host 192.168.0.1". The filter uses something called BPF (Berkeley Packet Filter) which is done kernelside (at least libpcap is doing the filter install with ioctls in pcap-bpf.c). So the cost of drinking from a Monitor firehose is much less than it sounds.

Besides, to userspace, this is almost identical. In both cases it opens
a socket, binds to something (either raw socket bound to netdev or
netlink socket bound to nl80211) and then stuffs frames into that socket
with some fixed header format (for most apps anyway)

I'm guessing the concern is to leave the crufty scary not-very-well-known Management Interface monster asleep lest it wake up while being edited and eat everyone :-)

-Andy
-
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[Index of Archives]     [Linux Host AP]     [ATH6KL]     [Linux Bluetooth]     [Linux Netdev]     [Kernel Newbies]     [Linux Kernel]     [IDE]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux ATA RAID]     [Samba]     [Device Mapper]
  Powered by Linux