Re: Cisco cards and rfmon oddities on FreeBSD.

Pedro la Peu writes:
| Some months ago I looked at FreeBSD's an driver and saw that it (and
| bpf, ancontrol etc.) supported rfmon mode. I don't use FreeBSD but I
| pulled the relevant code and added similar functionality to OpenBSD.
| 
| This mostly identical code works well for me on OpenBSD, but I'm also
| trying to support FreeBSD users on the Kismet lists/forums and it seems
| FreeBSD's rfmon mode doesn't work at all well for them. I'm a little
| mystified by the problems they are seeing.
| 
| Looking at the FreeBSD generated packet dumps that I've been sent two
| things seem to be happening:
| 
| 1) Most frames appear malformed according to ethereal. It looks like
| they are either truncated or have extra bytes inserted/appended.
| 
| 2) Many frames are ghosts, i.e. maybe the bssid or ssid are slightly
| different. To Kismet this looks like a new network, and there are a lot
| of frames like this. One network can show up as 30 or more ghost
| networks due to this.
| 
| Does anyone use Cisco 802.11 cards in rfmon mode on FreeBSD, and if so,
| are you seeing any problems? What might be the cause of these FreeBSD
| oddities, does anyone have any ideas?

Yes, lots of people.  Now you know why lots of AP in one place can make
things really slow.  I'm just copying the data of the air so what's
in the air is what you get.  Collisions in the air are really common.
What needs to be done is to detect a packet with a collision and
drop those packets by Kismet.  The driver shouldn't since they can
be useful to watch collisions in your air space.

I don't know how to check for a valid packet off the top of my head but
the should be a check.  Ethereal whines on some detail I forget (FCS?) the 
the card does not pass up in the 802.11 monitor mode that it wants or 
sends it up.  Not that RFMON is not pure monitor since if the WEP key
is provided it will decrypt the packet in hardware.  That will mess
up Ethereal.  I patch Ethereal to ignore the WEP processing and to 
show WEP de-crypted packets in sniff mode.  This in itself could 
invalidate the packet.

Doug A.
--
*bsd wireless list, a bawug thing <http://www.bawug.org/>
[un]subscribe: http://lists.bawug.org/mailman/listinfo/bsd-wireless/