mac80211-injection.rst 3.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106
  1. .. SPDX-License-Identifier: GPL-2.0
  2. =========================================
  3. How to use packet injection with mac80211
  4. =========================================
  5. mac80211 now allows arbitrary packets to be injected down any Monitor Mode
  6. interface from userland. The packet you inject needs to be composed in the
  7. following format::
  8. [ radiotap header ]
  9. [ ieee80211 header ]
  10. [ payload ]
  11. The radiotap format is discussed in
  12. ./Documentation/networking/radiotap-headers.rst.
  13. Despite many radiotap parameters being currently defined, most only make sense
  14. to appear on received packets. The following information is parsed from the
  15. radiotap headers and used to control injection:
  16. * IEEE80211_RADIOTAP_FLAGS
  17. ========================= ===========================================
  18. IEEE80211_RADIOTAP_F_FCS FCS will be removed and recalculated
  19. IEEE80211_RADIOTAP_F_WEP frame will be encrypted if key available
  20. IEEE80211_RADIOTAP_F_FRAG frame will be fragmented if longer than the
  21. current fragmentation threshold.
  22. ========================= ===========================================
  23. * IEEE80211_RADIOTAP_TX_FLAGS
  24. ============================= ========================================
  25. IEEE80211_RADIOTAP_F_TX_NOACK frame should be sent without waiting for
  26. an ACK even if it is a unicast frame
  27. ============================= ========================================
  28. * IEEE80211_RADIOTAP_RATE
  29. legacy rate for the transmission (only for devices without own rate control)
  30. * IEEE80211_RADIOTAP_MCS
  31. HT rate for the transmission (only for devices without own rate control).
  32. Also some flags are parsed
  33. ============================ ========================
  34. IEEE80211_RADIOTAP_MCS_SGI use short guard interval
  35. IEEE80211_RADIOTAP_MCS_BW_40 send in HT40 mode
  36. ============================ ========================
  37. * IEEE80211_RADIOTAP_DATA_RETRIES
  38. number of retries when either IEEE80211_RADIOTAP_RATE or
  39. IEEE80211_RADIOTAP_MCS was used
  40. * IEEE80211_RADIOTAP_VHT
  41. VHT mcs and number of streams used in the transmission (only for devices
  42. without own rate control). Also other fields are parsed
  43. flags field
  44. IEEE80211_RADIOTAP_VHT_FLAG_SGI: use short guard interval
  45. bandwidth field
  46. * 1: send using 40MHz channel width
  47. * 4: send using 80MHz channel width
  48. * 11: send using 160MHz channel width
  49. The injection code can also skip all other currently defined radiotap fields
  50. facilitating replay of captured radiotap headers directly.
  51. Here is an example valid radiotap header defining some parameters::
  52. 0x00, 0x00, // <-- radiotap version
  53. 0x0b, 0x00, // <- radiotap header length
  54. 0x04, 0x0c, 0x00, 0x00, // <-- bitmap
  55. 0x6c, // <-- rate
  56. 0x0c, //<-- tx power
  57. 0x01 //<-- antenna
  58. The ieee80211 header follows immediately afterwards, looking for example like
  59. this::
  60. 0x08, 0x01, 0x00, 0x00,
  61. 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
  62. 0x13, 0x22, 0x33, 0x44, 0x55, 0x66,
  63. 0x13, 0x22, 0x33, 0x44, 0x55, 0x66,
  64. 0x10, 0x86
  65. Then lastly there is the payload.
  66. After composing the packet contents, it is sent by send()-ing it to a logical
  67. mac80211 interface that is in Monitor mode. Libpcap can also be used,
  68. (which is easier than doing the work to bind the socket to the right
  69. interface), along the following lines:::
  70. ppcap = pcap_open_live(szInterfaceName, 800, 1, 20, szErrbuf);
  71. ...
  72. r = pcap_inject(ppcap, u8aSendBuffer, nLength);
  73. You can also find a link to a complete inject application here:
  74. https://wireless.wiki.kernel.org/en/users/Documentation/packetspammer
  75. Andy Green <andy@warmcat.com>