[Announce] Kismet + Fully functional WLAN monitor mode for the N900 - maemo.org

lxp | # 1 | 2010-05-11, 13:27 | Report

Hi,

Many of you may already have noticed that I have ported Kismet to the N900 with support for internal GPS through liblocation.
Now also a fully functional WLAN monitor mode is available for the N900! You might know the channel 6 problem, it's gone now!

Installation instructions can be found here.

More infos on my blog http://david.gnedt.eu/.

Monitor mode patch changelog:
Version 2 (included in titan's kernel-power 2.6.28-maemo35 and later)
* FIX: capture encrypted packets (thanks to hardkorek for reporting the bug)
* FIX: reported data rate and channel type

Version 1 (included in titan's kernel-power 2.6.28-maemo26 and later)
* Initial version

Best regards,
David

Last edited by lxp; 2010-05-25 at 12:00. Reason: Update for monitor mode patch version 2

The Following 65 Users Say Thank You to lxp For This Useful Post:
Sonic, aBs0lut3z33r0, ajax1, AlMehdi, apollovy, Benson, bimbim, casper27, clasificado, Cobra, codeMonkey, Crogge, defixio, dieg, eikido, fake, frals, GameboyRMH, hardkorek, hawaii, hesham, hycraig, igorgomes, Inacurate, indeo, inkirby, ioan, jahaugum, juise-, kingoddball, kmare, lcuk, littlebadger, lostinmirkwood, mail_e36, mannakiosk, MartinK, Megaltariak, Mentalist Traceur, MrWeasel, mveplus, nashith, nux, omeriko9, OptX, Patola, pH5, Pretoriano, qole, qwerty12, sebas, Shanezlar, sponka, stas123, stlpaul, terminal3, theonelaw, thommy, TiagoTiago, Tomaszd, tuxsavvy, Wanker, wimmme, zappa, zwer

hawaii | # 2 | 2010-05-11, 13:54 | Report

Well, I would just like to personally thank you for the WL1251 patch.

eikido | # 3 | 2010-05-11, 13:58 | Report

This is insane!
Cool man!

Could i use your chan 6 problem patch with aircrack since i know aircrack way better than kismet?

Eikido

OptX | # 4 | 2010-05-11, 14:12 | Report

Thanks a lot for this patch N900 getting more and more a greyhat

@eikido , aircrack works too. (kinda, since injection is not working)

Last edited by OptX; 2010-05-11 at 15:29.

lxp | # 5 | 2010-05-11, 14:14 | Report

Originally Posted by eikido View Post

Could i use your chan 6 problem patch with aircrack since i know aircrack way better than kismet?

It should work with any tool which uses the monitor mode. Nevertheless packet injection will currently not work.

I don't think that aircrack-ng suite is better for wardriving because it isn't directly designed for it. However the aircrack-ng suite is better in other fields

but as I already noted packet injection doesn't work, so I think aircrack is currently a little bit useless on the N900 (like kismet before) or did I miss something?

davidxfoo | # 6 | 2010-05-11, 14:45 | Report

This is cool! Thanks for the effort.

One question: using your patched driver, can tcpdump or wireshark output the signal strength of received wireless frames?

hawaii | # 7 | 2010-05-11, 14:47 | Report

@lxp;

Would you agree it's a tertiary firmware issue that's stopping live packet injection without being associated to an AP?

lxp | # 8 | 2010-05-11, 15:45 | Report

Originally Posted by davidxfoo View Post

One question: using your patched driver, can tcpdump or wireshark output the signal strength of received wireless frames?

I think it should work (if you put the card in monitor mode), but I haven't tested it yet.

Originally Posted by hawaii View Post

Would you agree it's a tertiary firmware issue that's stopping live packet injection without being associated to an AP?

Yes, I am quite sure as some testing showed the same during development of my monitor mode patch. The firmware is a bit crappy at all. It wasn't too easy to get the monitor mode working like it is now. Nevertheless there may be some tricks to also overcome the firmware issues for packet injection, but I can't tell for sure.

davidxfoo | # 9 | 2010-05-11, 17:16 | Report

Originally Posted by lxp View Post

I think it should work (if you put the card in monitor mode), but I haven't tested it yet.

lxp, could you do a quick test and let us know if you can see the signal strength? I remember on my n810 without patch, we can use monitor mode with tcpdump, but without signal strength information.

Thanks a lot.

lxp | # 10 | 2010-05-11, 17:34 | Report

Originally Posted by davidxfoo View Post

lxp, could you do a quick test and let us know if you can see the signal strength? I remember on my n810 without patch, we can use monitor mode with tcpdump, but without signal strength information.

Thanks a lot.

I have tested it and it works. The capture contains normal radiotap headers with MAC timestamp, Flags, Data Rate, Channel frequency, Channel type, DBM Antenna Signal, DBM Antenna Noise, Antenna.

Here is what I have done:

Code:

stop wlancond
ifconfig wlan0 down
iwconfig wlan0 mode monitor channel 6
ifconfig wlan0 up
tcpdump -i wlan0 -w test.cap
start wlancond

The Following 2 Users Say Thank You to lxp For This Useful Post:
davidxfoo