Date: Thu, 20 May 2004 08:50:29 -0700 From: Sam Leffler <sam@errno.com> To: Fish <fish@fish-mail.com> Cc: freebsd-mobile@freebsd.org Subject: Re: Orinoco Wireless Card and Monitor Mode w/ Kismet - No Longer Working? Message-ID: <200405200850.29662.sam@errno.com> In-Reply-To: <200405201138.52801.fish@fish-mail.com> References: <200405200904.37966.fish@fish-mail.com> <200405200825.06207.sam@errno.com> <200405201138.52801.fish@fish-mail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thursday 20 May 2004 08:38 am, Fish wrote: > On Thursday 20 May 2004 11:25 am, Sam Leffler wrote: > > On Thursday 20 May 2004 06:04 am, Fish wrote: > > > When I built from source I configured with --enable-syspcap and used > > > source=radiotap_fbsd_b,wi0,wtapb,10 as my source. > > > > You didn't mention what kernel you're running. radiotap support should > > work fine in current. > > > > Sam > > Sorry, thought I said I was running -current, guess not. > > bash-2.05b$ uname -a > FreeBSD somethingwicked 5.2-CURRENT FreeBSD 5.2-CURRENT #0: Sun May 16 > 23:57:02 EDT 2004 fish@somethingwicked:/usr/obj/usr/src/sys/CURRENT-TWO > i386 > > Here's the console output when I run the server... > > bash-2.05b$ sudo kismet_server > Will drop privs to fish (1001) gid 1001 > No specific sources given to be enabled, all will be enabled. > Enabling channel hopping. > Disabling channel splitting. > Source 0 (wtapb): Enabling monitor mode for radiotap_fbsd_b source > interface wi0 channel 10... > Source 0 (wtapb): Opening radiotap_fbsd_b source interface wi0... > WARNING: pcap reports link type of EN10MB but we'll fake it on BSD. Note this is wrong. > This may not work the way we want it to. > WARNING: Some Free- and Net- BSD drivers do not report rfmon packets > correctly. Kismet will probably not run correctly. For better > support, you should upgrade to a version of *BSD with Radiotap. > Spawned channelc control process 12761 > Dropped privs to fish (1001) gid 1001 > Allowing clients to fetch WEP keys. > Logging networks to /home/fish/kismet/20040520-Kismet-1-network.txt > Logging cryptographically weak packets > to /home/fish/kismet/20040520-Kismet-1-weak.txt > Logging cisco product information > to /home/fish/kismet/20040520-Kismet-1-cisco.txt > Logging data to /home/fish/kismet/20040520-Kismet-1-dump.txt > Writing data files to disk every 300 seconds. > Mangling encrypted and fuzzy data packets. > Tracking probe responses and associating probe networks. > Reading AP manufacturer data and defaults from /usr/local/etc/ap_manuf > Reading client manufacturer data and defaults from > /usr/local/etc/client_manuf Dump file format: wiretap (local code) dump > Crypt file format: airsnort (weak packet) dump > Kismet 2004.04.R1 (Kismet) > Logging data networks weak cisco > Listening on port 2501. > Allowing connections from 127.0.0.1/255.255.255.255 > Registering builtin client/server protocols... > Registering requested alerts... > Registering builtin timer events... > Gathering packets... > ^CDidn't detect any networks, unlinking network list. > Didn't detect any Cisco Discovery Packets, unlinking cisco dump > Didn't capture any packets, unlinking dump file > Didn't see any weak encryption packets, unlinking weak file > Sending termination request to channel control child 12761... > Waiting for channel control child 12761 to exit... > WARNING: Sometimes cards don't always come out of monitor mode > cleanly. If your card is not fully working, you may need to > restart or reconfigure it for normal operation. > Kismet exiting. > > Anything look amiss to anyone? To get radiotap-encapsulated frames you need to set the pcap link type to IEEE802_11_RADIO. You are sampling packets at the Ethernet level which means you won't see any of the 802.11 management frames that kismet needs to identify nodes in the network. An up to date kismet should do this automatically. There are versions of tcpdump that can do this too, but I believe you need the version from the ports tree as the mods haven't (yet) been incorporated in the system. Something like tcpdump -i wi0 -y should display the set of available link types and then tcpdump -i wi0 -L IEEE802_11_RADIO should work. If that's ok then your problem is with kismet; you must have the wrong sources. I always just take the most current code from CVS. Sam
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200405200850.29662.sam>