Hi folks -
iwl3945 with wlan0 associated on to WPA and a secondary mon0 interface
set into monitor mode.
packetspammer is running on mon0 as well in another session.
Notice that tcpdump has -XX so the radiotap header is visible.
# tcpdump -i mon0 -s0 -XX ether host 13:22:33:44:55:66
...
12:01:04.673737 0us tsft 18.0 Mb/s 2417 MHz (0x00c0) -34dB signal 0dB
noise antenna 1 13:22:33:44:55:66 (oui Unknown) Unknown SSAP 0x60 >
13:22:33:44:55:66 (oui Unknown) Unknown DSAP 0x50 Unnumbered, ua, Flags
[Response], length 77
0x0000: 0000 1900 6f08 0000 0000 0000 0000 0000 ....o...........
0x0010: 0024 7109 c000 de00 0108 0100 00ff ffff .$q.............
0x0020: ffff ff13 2233 4455 6613 2233 4455 6610 ...."3DUf."3DUf.
0x0030: 8650 6163 6b65 7473 7061 6d6d 6572 2031 .Packetspammer.1
0x0040: 3862 726f 6164 6361 7374 2070 6163 6b65 8broadcast.packe
0x0050: 7423 3030 3138 3020 2d2d 203a 2d44 202d t#00180.--.:-D.-
0x0060: 2d6d 6565 726b 6174 2e68 6f6d 652e 7761 -meerkat.home.wa
0x0070: 726d 6361 742e 636f 6d20 2d2d 2d2d rmcat.com.----
12:01:04.673755 [0x0000000f] 13:22:33:44:55:66 (oui Unknown) Unknown
SSAP 0x60 > 13:22:33:44:55:66 (oui Unknown) Unknown DSAP 0x50
Unnumbered, ua, Flags [Response], length 77
0x0000: 0000 0b00 0080 0200 0000 0008 0100 00ff ................
0x0010: ffff ffff ff13 2233 4455 6613 2233 4455 ......"3DUf."3DU
0x0020: 6610 8650 6163 6b65 7473 7061 6d6d 6572 f..Packetspammer
0x0030: 2031 3862 726f 6164 6361 7374 2070 6163 .18broadcast.pac
0x0040: 6b65 7423 3030 3138 3020 2d2d 203a 2d44 ket#00180.--.:-D
0x0050: 202d 2d6d 6565 726b 6174 2e68 6f6d 652e .--meerkat.home.
0x0060: 7761 726d 6361 742e 636f 6d20 2d2d 2d2d warmcat.com.----
Well as we noticed before in this mode with two interfaces we cannot
monitor external packetspammer traffic, so this traffic is actually our
transmit action inappropriately reflected into monitor mode.
Each injected transmit packet appears twice on the monitor interface,
once with a good radiotap header
0000 1900 6f08 0000 0000 0000 0000 0000 0024 7109 c000 de00 01
and then the same packet again (it was only transmitted once! Each
packetspammer payload has an incrementing number and the rate it was
transmitted at) with a bogus radiotap header
0000 0b00 0080 0200 0000 00
I decided to try this test with only wlan0 interface set to monitor mode
and packetspammer on wlan0 as well. But I was able to see only one
packet.....
# tcpdump -i wlan0 -s0 -XX ether host 13:22:33:44:55:66
tcpdump: WARNING: wlan0: no IPv4 address assigned
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on wlan0, link-type IEEE802_11_RADIO (802.11 plus BSD radio
information header), capture size 65535 bytes
12:03:38.477118 0us tsft 54.0 Mb/s 2417 MHz (0x00c0) -34dB signal 0dB
noise antenna 1 13:22:33:44:55:66 (oui Unknown) Unknown SSAP 0x60 >
13:22:33:44:55:66 (oui Unknown) Unknown DSAP 0x50 Unnumbered, ua, Flags
[Response], length 77
0x0000: 0000 1900 6f08 0000 0000 0000 0000 0000 ....o...........
0x0010: 006c 7109 c000 de00 0108 0100 00ff ffff .lq.............
0x0020: ffff ff13 2233 4455 6613 2233 4455 6610 ...."3DUf."3DUf.
0x0030: 8650 6163 6b65 7473 7061 6d6d 6572 2035 .Packetspammer.5
0x0040: 3462 726f 6164 6361 7374 2070 6163 6b65 4broadcast.packe
0x0050: 7423 3030 3030 3020 2d2d 203a 2d44 202d t#00000.--.:-D.-
0x0060: 2d6d 6565 726b 6174 2e68 6f6d 652e 7761 -meerkat.home.wa
0x0070: 726d 6361 742e 636f 6d20 2d2d 2d2d rmcat.com.----
... before the tcpdump and packetspammer processes froze, and on
modprobe -r iwl3945 the whole machine froze. Repeating the test got me
another freeze just from running packetspammer on wlan0 alone.
-Andy