Getting Support for Monitor Mode - Linux
In order to begin sniffing wireless traffic with Wi re s h a r k , your wireless card must be
in monitor mode.Wi reshark does not do this automatically; you have to man u a l l y
c o n fig u re your wireless card before starting your packet capture. H oweve r, the com-
mands you need in order to config u re the card in monitor mode can differ based
on the type of wireless card and driver that you are using.This section discusses
h ow to complete this step based on the most common wireless card and drive r
combination for Linux .
TIP: Determining the type of wireless card you have isn’t always easy. While
there are only a handful of manufacturers that make the wireless
chipset hardware, multiple vendors re-brand the cards, thus making it
difficult to identify what the actual chipset is. One resource for identi-
fying the chipset from the card manufacturer is available at
h t t p : / / l i n u x - w l e s s . p a s s y s . n l. If your specific card isn’t listed here you
can search using Google with the card name and keyword “chipset”
(e.g., WPC55AG chipset).
Linux Wireless Extensions Compatible Drivers
Most wireless drivers for Linux systems use the Linux Wireless Extensions interface,
providing a consistent configuration interface for manipulating the wireless card.
First, let’ s identify the wireless driver interface name by running the wireless card
configuration utility iwconfig with no parameters:
$ iwconfig
eth0 no wireless extensions.
lo no wireless extensions.
eth1 IEEE 802.11b ESSID:”Beacon Wi-Fi Network”
Mode:Managed Frequency:2.462 GHz Access Point:
00:02:2D:8B:70:2E
Bit Rate:11 Mb/s Tx-Power=20 dBm Sensitivity=8/0
Retry limit:7 RTS thr:off Fragment thr:off
Power Management:off
Link Quality=50/100 Signal level=-71 dBm Noise level=-86 dBm
Rx invalid nwid:0 Rx invalid crypt:0 Rx invalid frag:0
Tx excessive retries:0 Invalid misc:286 Missed beacon:5
NOTE
It is recommended that users take advantage of the Linux 2.6 kernel
whenever possible. Most Linux distributions install their wireless tools
packages for i w c o n fig and i w p r i v by default; you will need to install
these tools manually if they are not included with your default distribu-
tion. Use the package management utilities that come with your Linux
distribution to search for packages with the name “wireless-tools” to
identify installation options. Information specific to older Debian, SuSE,
RedHat, and Mandrake distributions is available at
w w w. h p l . h p . c o m / p e r s o n a l / J e a n _ To u r r i l h e s / L i n u x / D I S T R I B U T I O N S . t x t .
F rom this output, we determine that interfaces e t h 0 and l o do not support Linu x
Wi reless Extensions; h oweve r, i n t e r face e t h 1 does support wireless extensions. F ro m
the output, we can see that the card is currently in managed mode and is associated
with an IEEE 802.11b network with the Service Set Identifier (SSID) “Beacon Wi - F i
N e t wo r k ” at 2.462 GHz (channel 11).
274 Chapter 6 • Wireless Sniffing with WiresharkSince we want to use this wireless interface for wireless traffic sniffing, we need
to place the card in monitor mode. In order to make changes to the wireless card
configuration, we need to be the root user. Become the root user by running the su
command and supplying the root user password:
$ su
Password: (enter root password)
#
After becoming the root user, you can use the iwconfig utility to configure the
card for monitor mode, by specifying the interface name followed by mode monitor:
# iwconfig eth1 mode monitor
After placing the card in monitor mode, run the iwconfig utility with the inter-
face name as the only command-line argument, to verify the configuration change:
# iwconfig eth1
eth1 unassociated ESSID:off/any
Mode:Monitor Channel=0 Access Point: 00:00:00:00:00:00
Bit Rate:0 kb/s Tx-Power=20 dBm Sensitivity=8/0
Retry limit:7 RTS thr:off Fragment thr:off
Encryption key:off
Power Management:off
Link Quality:0 Signal level:0 Noise level:0
Rx invalid nwid:0 Rx invalid crypt:0 Rx invalid frag:0
Tx excessive retries:0 Invalid misc:7007 Missed beacon:0
In this output, we see that the mode has changed from managed to monitor.At
this point, the wireless card is operating in monitor mode.Next, we need to make
sure the interface is in the “up” state with the ifconfig utility , again using the interface
name as the only command-line parameter:
eth1 Link encap:UNSPEC HWaddr 00-13-CE-55-B5-EC-BC-A9-00-00-00-00-00-
00-00-00
BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:18176 errors:0 dropped:18462 overruns:0 frame:0
TX packets:123 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
Interrupt:11 Base address:0x4000 Memory:a8401000-a8401fff
Wireless Sniffing with Wireshark • Chapter 6 275The first indented line of text following the interface name and hardware
address (HWaddr) reports the operating flags for the interface. In this example, the
interface is configured to accept broadcast and multicast traffic.The interface is not
currently in the up state, due to the lack of the UP keyword.Modify the interface
configuration by placing the interface in the up state, then examine the interface
configuration properties as shown below:
eth1 Link encap:UNSPEC HWaddr 00-13-CE-55-B5-EC-3C-4D-00-00-00-00-00-
00-00-00
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:34604 errors:0 dropped:34583 overruns:0 frame:0
TX packets:232 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:18150 (17.7 Kb) TX bytes:0 (0.0 b)
Interrupt:11 Base address:0x4000 Memory:a8401000-a8401fff
In this output we see that the interface is now in the up state and is ready to
begin sniffing wireless traffic.
NOTE
Unlike the iwconfig tool, ifconfig does not understand the properties of
an interface that is in monitor mode. When associated to a wireless net-
work, the interface appears as a standard Ethernet interface; however,
when in monitor mode, it appears as an unknown or unspecified link
encapsulation mechanism. As a result, ifconfig displays a default of 16
bytes to represent the Media Access Control (MAC) address of the
unspecified interface encapsulation (denoted with the string UNSPEC). In
what appears to be a bug in the ifconfig tool, 8 bytes are printed to rep-
resent the MAC address, followed by 8 NULL bytes. The first 6 bytes rep-
resent the actual MAC address of the wireless card, followed by 2 bytes
of uninitialized memory.