[ath9k-devel] ath9k_htc - Netgear WNDA3200 - monitor mode

On 21 March 2016 at 22:28, Roger James <[email protected]> wrote:
> Hi,
>
> I am trying to use a Netgear WNDA3200 usb dongle plugged into a box
> running Ubuntu 15.10 to monitor a WPA2_PSK encrypted network. This stick
> uses the AR7010+AR9280 chipsets.  For the particular problem I am
> investigating I need to as much of the traffic on the channel as I can.
> However I seem to miss almost all of the unicast traffic. I have come
> across this problem many times before on other wireless chipsets. I was
> hoping the Atheros would be different. I can see unicast 802.11
> management traffic but not protected unicast data/qos data frames. I
> have hacked the driver to give me  the current filter settings via
> debugfs and this is what I see.
>
> RXFILTER: 0xc03f UCAST MCAST BCAST CONTROL BEACON PROM PSPOLL
> MCAST_BCAST_ALL
>
> Which looks OK to me. I have also checked that all the packets seen by
> driver make it up to user level.
>
> Is this expected behaviour?
>
> Is this something to do with htc USB chipset?
>
> Is this something to do with a Netgear customisation?
>
> Has anyone else seen this kind of behaviour?
>
> Is there any way round it?
>
> Help!! This is driving me nuts. I have done so many tests with this and
> other adapters that I have lost the plot.
>
> I have a whole slew of tests and results available on request. But I
> won't clutter the list with them.
>
I think this is expected, while USB device have to use HW/internal
buffers for frames (next send them to PC).
So, this memory is limited and in case of heavy traffic lot of frame
will be lost. I am not sure how many frames could be buffered (just
guessing - about 10?).

So, best choice for sniffer is a PCI (PCIex) card where HW using
memory from PC mapped via DMA. So, you can get all frames in such
case.
In my setup I am using ath9k (AR9462 dualband) and ath10k, Intel7260
for VHT. All of them works very good.

BR
Janusz

> Roger
>
> _______________________________________________
> ath9k-devel mailing list
> ath9k-devel at lists.ath9k.org
> https://lists.ath9k.org/mailman/listinfo/ath9k-devel