Search Linux Wireless

Bogus double self-monitoring with multiple interfaces

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi folks -

iwl3945 with wlan0 associated on to WPA and a secondary mon0 interface
set into monitor mode.

packetspammer is running on mon0 as well in another session.

Notice that tcpdump has -XX so the radiotap header is visible.

# tcpdump -i mon0 -s0 -XX ether host 13:22:33:44:55:66
...
12:01:04.673737 0us tsft 18.0 Mb/s 2417 MHz (0x00c0) -34dB signal 0dB
noise antenna 1 13:22:33:44:55:66 (oui Unknown) Unknown SSAP 0x60 >
13:22:33:44:55:66 (oui Unknown) Unknown DSAP 0x50 Unnumbered, ua, Flags
[Response], length 77
        0x0000:  0000 1900 6f08 0000 0000 0000 0000 0000  ....o...........
        0x0010:  0024 7109 c000 de00 0108 0100 00ff ffff  .$q.............
        0x0020:  ffff ff13 2233 4455 6613 2233 4455 6610  ...."3DUf."3DUf.
        0x0030:  8650 6163 6b65 7473 7061 6d6d 6572 2031  .Packetspammer.1
        0x0040:  3862 726f 6164 6361 7374 2070 6163 6b65  8broadcast.packe
        0x0050:  7423 3030 3138 3020 2d2d 203a 2d44 202d  t#00180.--.:-D.-
        0x0060:  2d6d 6565 726b 6174 2e68 6f6d 652e 7761  -meerkat.home.wa
        0x0070:  726d 6361 742e 636f 6d20 2d2d 2d2d       rmcat.com.----
12:01:04.673755 [0x0000000f] 13:22:33:44:55:66 (oui Unknown) Unknown
SSAP 0x60 > 13:22:33:44:55:66 (oui Unknown) Unknown DSAP 0x50
Unnumbered, ua, Flags [Response], length 77
        0x0000:  0000 0b00 0080 0200 0000 0008 0100 00ff  ................
        0x0010:  ffff ffff ff13 2233 4455 6613 2233 4455  ......"3DUf."3DU
        0x0020:  6610 8650 6163 6b65 7473 7061 6d6d 6572  f..Packetspammer
        0x0030:  2031 3862 726f 6164 6361 7374 2070 6163  .18broadcast.pac
        0x0040:  6b65 7423 3030 3138 3020 2d2d 203a 2d44  ket#00180.--.:-D
        0x0050:  202d 2d6d 6565 726b 6174 2e68 6f6d 652e  .--meerkat.home.
        0x0060:  7761 726d 6361 742e 636f 6d20 2d2d 2d2d  warmcat.com.----

Well as we noticed before in this mode with two interfaces we cannot
monitor external packetspammer traffic, so this traffic is actually our
transmit action inappropriately reflected into monitor mode.

Each injected transmit packet appears twice on the monitor interface,
once with a good radiotap header

0000 1900 6f08 0000 0000 0000 0000 0000 0024 7109 c000 de00 01

and then the same packet again (it was only transmitted once!  Each
packetspammer payload has an incrementing number and the rate it was
transmitted at) with a bogus radiotap header

0000 0b00 0080 0200 0000 00


I decided to try this test with only wlan0 interface set to monitor mode
and packetspammer on wlan0 as well.  But I was able to see only one
packet.....


# tcpdump -i wlan0 -s0 -XX ether host 13:22:33:44:55:66
tcpdump: WARNING: wlan0: no IPv4 address assigned
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on wlan0, link-type IEEE802_11_RADIO (802.11 plus BSD radio
information header), capture size 65535 bytes
12:03:38.477118 0us tsft 54.0 Mb/s 2417 MHz (0x00c0) -34dB signal 0dB
noise antenna 1 13:22:33:44:55:66 (oui Unknown) Unknown SSAP 0x60 >
13:22:33:44:55:66 (oui Unknown) Unknown DSAP 0x50 Unnumbered, ua, Flags
[Response], length 77
        0x0000:  0000 1900 6f08 0000 0000 0000 0000 0000  ....o...........
        0x0010:  006c 7109 c000 de00 0108 0100 00ff ffff  .lq.............
        0x0020:  ffff ff13 2233 4455 6613 2233 4455 6610  ...."3DUf."3DUf.
        0x0030:  8650 6163 6b65 7473 7061 6d6d 6572 2035  .Packetspammer.5
        0x0040:  3462 726f 6164 6361 7374 2070 6163 6b65  4broadcast.packe
        0x0050:  7423 3030 3030 3020 2d2d 203a 2d44 202d  t#00000.--.:-D.-
        0x0060:  2d6d 6565 726b 6174 2e68 6f6d 652e 7761  -meerkat.home.wa
        0x0070:  726d 6361 742e 636f 6d20 2d2d 2d2d       rmcat.com.----

... before the tcpdump and packetspammer processes froze, and on
modprobe -r iwl3945 the whole machine froze.  Repeating the test got me
another freeze just from running packetspammer on wlan0 alone.

-Andy
-
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[Index of Archives]     [Linux Host AP]     [ATH6KL]     [Linux Bluetooth]     [Linux Netdev]     [Kernel Newbies]     [Linux Kernel]     [IDE]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux ATA RAID]     [Samba]     [Device Mapper]
  Powered by Linux