Tuesday, May 6, 2014

Give you WLAN NIC a monitor job

1. Use airmon-ng to put your WLAN NIC into monitor mode. With
$ airmon-ng start wlanX
you create a "monY" interface used for capturing frames. If this is the first monitor interface you'll make it will probably be named as "mon0"
2. Check if your interface is working with "airodump-ng". Sometimes it doesn't  which will require you to either re-plug your NIC or even reboot your Linux maschine.
$ airodump-ng monY
If you see networks and other info appear there on the screen it's working.

3. Now set your card to listen only on a specific channel. Some prefere to use "airodump-ng" for that but I prefer "iw" since I can set regulatory domain and channel width with it. First thing is to set the regulatory domain of your NIC which will enable you to use channels of interest. You set the regulatory with
$ iw reg set XX
where XX is one of the countries from this list http://en.wikipedia.org/wiki/ISO_3166-1_alpha-2. 
After that check to see if the setting of regulatory domain took hold with
$ iw reg get

4. For the last part you can set a specific channel to listen on and the channel width if you are using channel bonding. The syntax is
iw phy <phyname> set channel <channel> [HT20|HT40+|HT40-]
which means that we first need a "phyname". If you didn't remember WLAN NICs phy name in step one you can get it with the "iw list" command. It will list all of your NICs information which there's a lot of, so I suggest you grep what you need with something like
$ iw list | grep phy
If you've got only one phy you'll know which name to use. If you've got more than one then you'll need to know on which one you have enabled monitoring. You can do this by setting a channel on one phy and check if the channel is fixed by either using wireshark or better tshark which dumps captured data directly in the terminal. With
$ iw phy phy2 set channel 132 HT40+
you set your NIC to listen on bonded channel 132. You could use a frequency (5660) instead of channel number if you prefer which might be a good idea for later when we will check our settings.
For listening on bonded channels use either HT40+ or HT40- option. In the above option I used the HT40+ option. Be careful here as you can't just use any option with a selected channel. Below is a list of Supported 40MHz combinations of 802.11n channels in the 5GHz spectrum.
(36,1) (40,-1); (44,1) (48,-1); (52,1) (56,-1); (60,1) (64,-1); (100,1) (104,-1); (108,1) (112,-1); (116,1) (120,-1); (124,1) (128,-1); (132,1) (136,-1); (149,1) (153,-1); (157,1) (161,-1)

5. To check if everything is owrking now tshark or wireshark, whichever you prefer. For tshark use the following

$ tshark -i monX -T fields -e radiotap.channel.freq

Here I say to tshark to use my monitor interface (-i) monX (X is whichever was created) and to display only specific fields with the "-T fileds  -e radiotap.channel.freq". In this case I'm interested only in frequency to see if my card is working properly.
You should see numbers that correspond to the frequency you have set on your adapter and they should all be the same all the time. It will require you to use an adapter that can produce "radiotap" headers. For more on those I suggest you read Nigel Bowden's blog here http://wifinigel.blogspot.com/2013/11/what-are-radiotap-headers.html

No comments:

Post a Comment

Note: Only a member of this blog may post a comment.