tjh.dev
Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
1How to use packet injection with mac80211
2=========================================
3
4mac80211 now allows arbitrary packets to be injected down any Monitor Mode
5interface from userland. The packet you inject needs to be composed in the
6following format:
7
8 [ radiotap header ]
9 [ ieee80211 header ]
10 [ payload ]
11
12The radiotap format is discussed in
13./Documentation/networking/radiotap-headers.txt.
14
15Despite 13 radiotap argument types are currently defined, most only make sense
16to appear on received packets. Currently three kinds of argument are used by
17the injection code, although it knows to skip any other arguments that are
18present (facilitating replay of captured radiotap headers directly):
19
20 - IEEE80211_RADIOTAP_RATE - u8 arg in 500kbps units (0x02 --> 1Mbps)
21
22 - IEEE80211_RADIOTAP_ANTENNA - u8 arg, 0x00 = ant1, 0x01 = ant2
23
24 - IEEE80211_RADIOTAP_DBM_TX_POWER - u8 arg, dBm
25
26Here is an example valid radiotap header defining these three parameters
27
28 0x00, 0x00, // <-- radiotap version
29 0x0b, 0x00, // <- radiotap header length
30 0x04, 0x0c, 0x00, 0x00, // <-- bitmap
31 0x6c, // <-- rate
32 0x0c, //<-- tx power
33 0x01 //<-- antenna
34
35The ieee80211 header follows immediately afterwards, looking for example like
36this:
37
38 0x08, 0x01, 0x00, 0x00,
39 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
40 0x13, 0x22, 0x33, 0x44, 0x55, 0x66,
41 0x13, 0x22, 0x33, 0x44, 0x55, 0x66,
42 0x10, 0x86
43
44Then lastly there is the payload.
45
46After composing the packet contents, it is sent by send()-ing it to a logical
47mac80211 interface that is in Monitor mode. Libpcap can also be used,
48(which is easier than doing the work to bind the socket to the right
49interface), along the following lines:
50
51 ppcap = pcap_open_live(szInterfaceName, 800, 1, 20, szErrbuf);
52...
53 r = pcap_inject(ppcap, u8aSendBuffer, nLength);
54
55You can also find sources for a complete inject test applet here:
56
57http://penumbra.warmcat.com/_twk/tiki-index.php?page=packetspammer
58
59Andy Green <andy@warmcat.com>