[ath9k-devel] ath9k_htc - Netgear WNDA3200 - monitor mode

On 22 Mar 2016 05:40, Janusz Dziedzic <[email protected]> wrote:
>
> On 21 March 2016 at 22:28, Roger James <[email protected]> wrote: 
> > Hi, 
> > 
> > I am trying to use a Netgear WNDA3200 usb dongle plugged into a box 
> > running Ubuntu 15.10 to monitor a WPA2_PSK encrypted network. This stick 
> > uses the AR7010+AR9280 chipsets.? For the particular problem I am 
> > investigating I need to as much of the traffic on the channel as I can. 
> > However I seem to miss almost all of the unicast traffic. I have come 
> > across this problem many times before on other wireless chipsets. I was 
> > hoping the Atheros would be different. I can see unicast 802.11 
> > management traffic but not protected unicast data/qos data frames. I 
> > have hacked the driver to give me? the current filter settings via 
> > debugfs and this is what I see. 
> > 
> > RXFILTER: 0xc03f UCAST MCAST BCAST CONTROL BEACON PROM PSPOLL 
> > MCAST_BCAST_ALL 
> > 
> > Which looks OK to me. I have also checked that all the packets seen by 
> > driver make it up to user level. 
> > 
> > Is this expected behaviour? 
> > 
> > Is this something to do with htc USB chipset? 
> > 
> > Is this something to do with a Netgear customisation? 
> > 
> > Has anyone else seen this kind of behaviour? 
> > 
> > Is there any way round it? 
> > 
> > Help!! This is driving me nuts. I have done so many tests with this and 
> > other adapters that I have lost the plot. 
> > 
> > I have a whole slew of tests and results available on request. But I 
> > won't clutter the list with them. 
> > 
> I think this is expected, while USB device have to use HW/internal 
> buffers for frames (next send them to PC). 
> So, this memory is limited and in case of heavy traffic lot of frame 
> will be lost. I am not sure how many frames could be buffered (just 
> guessing - about 10?). 
>
> So, best choice for sniffer is a PCI (PCIex) card where HW using 
> memory from PC mapped via DMA. So, you can get all frames in such 
> case. 
> In my setup I am using ath9k (AR9462 dualband) and ath10k, Intel7260 
> for VHT. All of them works very good. 
>
> BR 
> Janusz 
>
Hi Janusz,

The network does not carry much traffic and there are no other networks in the area. So I am not sure that frame loss due to buffering is a problem.

Roger