Dear All, I am a researcher on 802.11 network security. I am doing a project where the first two stations are communicating and the third station tries to inject an forged 802.11 ACK if the last data frame is lost. The ACK must be arrived to the data sender before the ACK timer expires. Therefore the third station should not wait for a DIFS and a random backoff to send out the ACK. I am using ath9k driver, I found two functions ath9k_hw_set_sifs_time() and ath9k_hw_setslottime() in the Hw.c file in the ath9k directory, which set the SIFS and backoff slot time in the registers.. I search all the ath9k files and found no register is for setting the DIFS. but the DIFS is can be calculated by DIFS = SIFS + 2 * Slot Time. Therefore I thought the wireless chips should calculate DIFS this way. I used to believe that I solved the problem by just setting the two registers. However,when I capture the raw frames using the airdump-ng ( an aircrack-ng module) and found that it takes more than 80 microseconds to appear after the data, which is much longer than the ACK timer out. The ACK timeout is usually 30 microseconds. So the third station is forced by me to send out a forged ACK at around 25 microsecond. Can any one tell me whether I am doing the right way to make the third station not follow the 802.11 backoff. any suggestion would be much appreciated. Thank you. Regards, Wei
