RE: monitor mode

So Prism chipsets are preferable in Linux? Which card do you think the
most flexible in features? Can I monitor the MAC layer events and the dhcp
messages in monitor mode?

Thanks in advance!
suihong

On Mon, 15 Nov 2004, Balint wrote:

> Date: Mon, 15 Nov 2004 14:06:42 +1100
> From: Balint <[email protected]>
> Reply-To: [email protected]
> To: [email protected]
> Subject: RE: [at76c503a-user] monitor mode
>
> Hi Suihong,
>
> Unfortunately the firmware does not support monitor mode.
> The "monitor" that iwpriv reports is a 'hacked up' quasi-monitor mode that I
> added to the driver. What it lets you do is use any application (eg: Kismet,
> Ethereal) with the WiFi adapter by fooling it into thinking it supports
> proper full monitor mode (as if it would collect all WiFi frames on a given
> channel). With this driver, the only information that gets sent through to
> these apps are the management (probe/beacon/response/...) frames sent by
> other cards and broadcasting APs (so software channel hopping actually does
> nothing). Personally I still find this to be quite useful as I'm going to
> put my adapter into a wok, and - volia - you get a Woktenna (some fun
> experimentation).
>
> The (x, y) numbers for "monitor" are:
> (x) whether you want to enable monitor mode or not (0 - off, 1 - on & use
> Prism frame headers (Kismet uses this, for example, to extract signal power
> info, 2 - on but don't encapsulate in Prism headers), and
> (y) the channel you want to listen to (1-14, but as I said has no effect
> here).
>
> The driver also supports the other method of setting monitor mode, which can
> be done through "iwconfig <interface> mode Monitor". The "iwpriv" way is
> simply for compatibility with apps such as Kismet.
>
> To perform your ethereal logging, you'll actually have to connect to the
> network you want to monitor first. Then you can use ethereal to log packets
> as if you were connected to, say, a normal LAN. (i.e.: not including WiFi
> encapsulation info, as you would get with proper monitor mode).
>
> So sorry :) I recommend that you go and buy a proper PCMCIA WiFi card. If
> you get any old rebadged Orinoco based card (I have an Avaya, but that's the
> same as Cabletron, etc, etc...) it'll work wonders with Kismet, Ethereal,
> Airsnort, etc. You can then purchase a pigtail if you wish and make a
> cantenna (they're really quite fantastic, I've built two and now I'm
> building a discone).
>
> Hope this helped!
> Balint
>
> > -----Original Message-----
> > From: [email protected] [mailto:at76c503a-user-
> > [email protected]] On Behalf Of Suihong Liang
> > Sent: Monday, 15 November 2004 10:11 AM
> > To: [email protected]
> > Subject: [at76c503a-user] monitor mode
> >
> > Hi everyone,
> >
> > I have questions about the monitor mode of atmel chipset. From iwpriv, I
> > saw "monitor          (8BF2) : set   2 int   & get   0", does it mean
> > monitor mode is supported by the firmware and driver?
> >
> > However, I couldn't find useful information on using iwpriv to change the
> > modes, could someone please explain the numbers (x, y) in "#iwpriv wlan0
> > monitor x y"?
> >
> > The last question is that I want to use ethereal to log the events of
> > scan/authentication/association as well as the dhcp packets, how do I
> > monitor all these?
> >
> > Btw, my machine has Fedora 3 and Linksys WUSB11 v2.8. Any comments would
> > be appriciated!
> >
> > Thanks!
> > suihong
> > _______________________________________________
> > at76c503a-user mailing list
> > [email protected]
> > http://lists.berlios.de/mailman/listinfo/at76c503a-user
> _______________________________________________
> at76c503a-user mailing list
> [email protected]
> http://lists.berlios.de/mailman/listinfo/at76c503a-user
>