[ath9k-devel] ath9k_htc - Netgear WNDA3200 - monitor mode

[ath9k-devel] ath9k_htc - Netgear WNDA3200 - monitor mode

[Roger James]

Hi,

I am trying to use a Netgear WNDA3200 usb dongle plugged into a box 
running Ubuntu 15.10 to monitor a WPA2_PSK encrypted network. This stick 
uses the AR7010+AR9280 chipsets.  For the particular problem I am 
investigating I need to as much of the traffic on the channel as I can. 
However I seem to miss almost all of the unicast traffic. I have come 
across this problem many times before on other wireless chipsets. I was 
hoping the Atheros would be different. I can see unicast 802.11 
management traffic but not protected unicast data/qos data frames. I 
have hacked the driver to give me  the current filter settings via 
debugfs and this is what I see.

RXFILTER: 0xc03f UCAST MCAST BCAST CONTROL BEACON PROM PSPOLL 
MCAST_BCAST_ALL

Which looks OK to me. I have also checked that all the packets seen by 
driver make it up to user level.

Is this expected behaviour?

Is this something to do with htc USB chipset?

Is this something to do with a Netgear customisation?

Has anyone else seen this kind of behaviour?

Is there any way round it?

Help!! This is driving me nuts. I have done so many tests with this and 
other adapters that I have lost the plot.

I have a whole slew of tests and results available on request. But I 
won't clutter the list with them.

Roger

[ath9k-devel] ath9k_htc - Netgear WNDA3200 - monitor mode

[Janusz Dziedzic]

On 21 March 2016 at 22:28, Roger James <roger@beardandsandals.co.uk> wrote:
> Hi,
>
> I am trying to use a Netgear WNDA3200 usb dongle plugged into a box
> running Ubuntu 15.10 to monitor a WPA2_PSK encrypted network. This stick
> uses the AR7010+AR9280 chipsets.  For the particular problem I am
> investigating I need to as much of the traffic on the channel as I can.
> However I seem to miss almost all of the unicast traffic. I have come
> across this problem many times before on other wireless chipsets. I was
> hoping the Atheros would be different. I can see unicast 802.11
> management traffic but not protected unicast data/qos data frames. I
> have hacked the driver to give me  the current filter settings via
> debugfs and this is what I see.
>
> RXFILTER: 0xc03f UCAST MCAST BCAST CONTROL BEACON PROM PSPOLL
> MCAST_BCAST_ALL
>
> Which looks OK to me. I have also checked that all the packets seen by
> driver make it up to user level.
>
> Is this expected behaviour?
>
> Is this something to do with htc USB chipset?
>
> Is this something to do with a Netgear customisation?
>
> Has anyone else seen this kind of behaviour?
>
> Is there any way round it?
>
> Help!! This is driving me nuts. I have done so many tests with this and
> other adapters that I have lost the plot.
>
> I have a whole slew of tests and results available on request. But I
> won't clutter the list with them.
>
I think this is expected, while USB device have to use HW/internal
buffers for frames (next send them to PC).
So, this memory is limited and in case of heavy traffic lot of frame
will be lost. I am not sure how many frames could be buffered (just
guessing - about 10?).

So, best choice for sniffer is a PCI (PCIex) card where HW using
memory from PC mapped via DMA. So, you can get all frames in such
case.
In my setup I am using ath9k (AR9462 dualband) and ath10k, Intel7260
for VHT. All of them works very good.

BR
Janusz

> Roger
>
> _______________________________________________
> ath9k-devel mailing list
> ath9k-devel at lists.ath9k.org
> https://lists.ath9k.org/mailman/listinfo/ath9k-devel

[ath9k-devel] ath9k_htc - Netgear WNDA3200 - monitor mode

[Oleksij Rempel]

Am 21.03.2016 um 22:28 schrieb Roger James:
> Hi,
> 
> I am trying to use a Netgear WNDA3200 usb dongle plugged into a box 
> running Ubuntu 15.10 to monitor a WPA2_PSK encrypted network. This stick 
> uses the AR7010+AR9280 chipsets.  For the particular problem I am 
> investigating I need to as much of the traffic on the channel as I can. 
> However I seem to miss almost all of the unicast traffic. I have come 
> across this problem many times before on other wireless chipsets. I was 
> hoping the Atheros would be different. I can see unicast 802.11 
> management traffic but not protected unicast data/qos data frames. I 
> have hacked the driver to give me  the current filter settings via 
> debugfs and this is what I see.
> 
> RXFILTER: 0xc03f UCAST MCAST BCAST CONTROL BEACON PROM PSPOLL 
> MCAST_BCAST_ALL
> 
> Which looks OK to me. I have also checked that all the packets seen by 
> driver make it up to user level.
> 
> Is this expected behaviour?
> 
> Is this something to do with htc USB chipset?
> 
> Is this something to do with a Netgear customisation?
> 
> Has anyone else seen this kind of behaviour?
> 
> Is there any way round it?
> 
> Help!! This is driving me nuts. I have done so many tests with this and 
> other adapters that I have lost the plot.
> 
> I have a whole slew of tests and results available on request. But I 
> won't clutter the list with them.

I would not guarantee that all filter settings are passed correctly. You
will need need to check it in the firmware.
https://github.com/qca/open-ath9k-htc-firmware


-- 
Regards,
Oleksij

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 213 bytes
Desc: OpenPGP digital signature
Url : http://lists.ath9k.org/pipermail/ath9k-devel/attachments/20160322/8367b2a6/attachment.pgp 

[ath9k-devel] ath9k_htc - Netgear WNDA3200 - monitor mode

[Roger James]

On 22 Mar 2016 05:40, Janusz Dziedzic <janusz.dziedzic@tieto.com> wrote:
>
> On 21 March 2016 at 22:28, Roger James <roger@beardandsandals.co.uk> wrote: 
> > Hi, 
> > 
> > I am trying to use a Netgear WNDA3200 usb dongle plugged into a box 
> > running Ubuntu 15.10 to monitor a WPA2_PSK encrypted network. This stick 
> > uses the AR7010+AR9280 chipsets.? For the particular problem I am 
> > investigating I need to as much of the traffic on the channel as I can. 
> > However I seem to miss almost all of the unicast traffic. I have come 
> > across this problem many times before on other wireless chipsets. I was 
> > hoping the Atheros would be different. I can see unicast 802.11 
> > management traffic but not protected unicast data/qos data frames. I 
> > have hacked the driver to give me? the current filter settings via 
> > debugfs and this is what I see. 
> > 
> > RXFILTER: 0xc03f UCAST MCAST BCAST CONTROL BEACON PROM PSPOLL 
> > MCAST_BCAST_ALL 
> > 
> > Which looks OK to me. I have also checked that all the packets seen by 
> > driver make it up to user level. 
> > 
> > Is this expected behaviour? 
> > 
> > Is this something to do with htc USB chipset? 
> > 
> > Is this something to do with a Netgear customisation? 
> > 
> > Has anyone else seen this kind of behaviour? 
> > 
> > Is there any way round it? 
> > 
> > Help!! This is driving me nuts. I have done so many tests with this and 
> > other adapters that I have lost the plot. 
> > 
> > I have a whole slew of tests and results available on request. But I 
> > won't clutter the list with them. 
> > 
> I think this is expected, while USB device have to use HW/internal 
> buffers for frames (next send them to PC). 
> So, this memory is limited and in case of heavy traffic lot of frame 
> will be lost. I am not sure how many frames could be buffered (just 
> guessing - about 10?). 
>
> So, best choice for sniffer is a PCI (PCIex) card where HW using 
> memory from PC mapped via DMA. So, you can get all frames in such 
> case. 
> In my setup I am using ath9k (AR9462 dualband) and ath10k, Intel7260 
> for VHT. All of them works very good. 
>
> BR 
> Janusz 
>
Hi Janusz,

The network does not carry much traffic and there are no other networks in the area. So I am not sure that frame loss due to buffering is a problem.

Roger

[ath9k-devel] ath9k_htc - Netgear WNDA3200 - monitor mode

[Roger James]

On 22 Mar 2016 06:13, Oleksij Rempel <linux@rempel-privat.de> wrote:
>
> Am 21.03.2016 um 22:28 schrieb Roger James: 
> > Hi, 
> > 
> > I am trying to use a Netgear WNDA3200 usb dongle plugged into a box 
> > running Ubuntu 15.10 to monitor a WPA2_PSK encrypted network. This stick 
> > uses the AR7010+AR9280 chipsets.? For the particular problem I am 
> > investigating I need to as much of the traffic on the channel as I can. 
> > However I seem to miss almost all of the unicast traffic. I have come 
> > across this problem many times before on other wireless chipsets. I was 
> > hoping the Atheros would be different. I can see unicast 802.11 
> > management traffic but not protected unicast data/qos data frames. I 
> > have hacked the driver to give me? the current filter settings via 
> > debugfs and this is what I see. 
> > 
> > RXFILTER: 0xc03f UCAST MCAST BCAST CONTROL BEACON PROM PSPOLL 
> > MCAST_BCAST_ALL 
> > 
> > Which looks OK to me. I have also checked that all the packets seen by 
> > driver make it up to user level. 
> > 
> > Is this expected behaviour? 
> > 
> > Is this something to do with htc USB chipset? 
> > 
> > Is this something to do with a Netgear customisation? 
> > 
> > Has anyone else seen this kind of behaviour? 
> > 
> > Is there any way round it? 
> > 
> > Help!! This is driving me nuts. I have done so many tests with this and 
> > other adapters that I have lost the plot. 
> > 
> > I have a whole slew of tests and results available on request. But I 
> > won't clutter the list with them. 
>
> I would not guarantee that all filter settings are passed correctly. You 
> will need need to check it in the firmware. 
> https://github.com/qca/open-ath9k-htc-firmware 
>
>
> -- 
> Regards, 
> Oleksij 
>
 Hi Oleksij,

I have already done that and the code looks reasonable.

Roger