You are not logged in.

#1 2017-01-11 23:09:41

thefiercerabbit
Member
Registered: 2016-09-29
Posts: 13

Interface in monitor mode stops capturing packets

Hi all,

I thought I would ask to the wireshark community, but it seems to be more a linux problem.

What I do is that I put my card in monitor mode (create the interface wlp3s0mon) and capture all packets from my access point. Whatever the purpose is, it works fine.
However, after a while (can be quite long actually), my card does not capture any new packet. If I stop the capture, and start it again, I still get no packet.
Two ways to make it capture again:
   - first I kill the main capture program, so my card is not busy;
   - then, either

 ifconfig wlp3s0mon down && ifconfig wlp3s0mon up

              or

 iwconfig wlp3s0mon channel some-other-channel && iwconfig wlp3s0mon channel original_channel

After that, I can start my capture again, and I get packets.

If some more explications are needed regarding the script, I am using dumpcap which directly pipes the captured packets to tshark (standard sdout pipe).

I don't have a lot of ideas why I am experiencing this issue, and that is why I'm here asking for help. It thought that maybe the pipe was full, but then kill and relaunch the script would be enough. Or maybe some process tries to do some stuff on the interface while scanning, causing it to stop... but the interface is created via airmon-ng (which delete the managed one and create the monitored one) and thus should not be bothered by other processes.

I tried to create some traffic on the network, and it seems that it helps stopping the capture sooner. However, it still looks like unpredictable.

Additional notes:
   - I have no issue when I use the card in managed mode, connected to an AP;
   - the interface is still in monitor mode when it stops capturing packets;
   - the interface is not managed by NetworkManager/dchpd/dhclient/wpa_supplicant.

Hardware information:

ifconfig wlp3s0mon
wlp3s0mon: flags=867<UP,BROADCAST,NOTRAILERS,RUNNING,PROMISC,ALLMULTI>  mtu 1500
        unspec 48-45-20-E2-05-6D-60-36-00-00-00-00-00-00-00-00  txqueuelen 1000  (UNSPEC)
        RX packets 3343997  bytes 1980254520 (1.8 GiB)
        RX errors 0  dropped 452135  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
iwconfig wlp3s0mon 
wlp3s0mon  IEEE 802.11  Mode:Monitor  Frequency:2.462 GHz  Tx-Power=0 dBm   
          Retry short limit:7   RTS thr:off   Fragment thr:off
          Power Management:on
lspci -nn -d 8086:095a -vv
03:00.0 Network controller [0280]: Intel Corporation Wireless 7265 [8086:095a] (rev 59)
	Subsystem: Intel Corporation Dual Band Wireless-AC 7265 [8086:5110]
	Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin A routed to IRQ 128
	Region 0: Memory at df100000 (64-bit, non-prefetchable) [size=8K]
	Capabilities: <access denied>
	Kernel driver in use: iwlwifi
	Kernel modules: iwlwifi

Last edited by thefiercerabbit (2017-01-12 09:29:25)

Offline

#2 2017-01-12 00:27:13

thefiercerabbit
Member
Registered: 2016-09-29
Posts: 13

Re: Interface in monitor mode stops capturing packets

Some interesting log from dmesg:

c[    1.858311] iwlwifi 0000:03:00.0: Direct firmware load for iwlwifi-7265D-24.ucode failed with error -2
[    1.858340] iwlwifi 0000:03:00.0: Direct firmware load for iwlwifi-7265D-23.ucode failed with error -2
[    1.863815] iwlwifi 0000:03:00.0: loaded firmware version 22.361476.0 op_mode iwlmvm
[    1.897613] iwlwifi 0000:03:00.0: Detected Intel(R) Dual Band Wireless AC 7265, REV=0x210
[    1.899689] iwlwifi 0000:03:00.0: L1 Enabled - LTR Enabled
[    1.899981] iwlwifi 0000:03:00.0: L1 Enabled - LTR Enabled
[    2.046435] iwlwifi 0000:03:00.0 wlp3s0: renamed from wlan0
[    2.178817] iwlwifi 0000:03:00.0: L1 Enabled - LTR Enabled
[    2.179026] iwlwifi 0000:03:00.0: L1 Enabled - LTR Enabled
[    2.252439] iwlwifi 0000:03:00.0: L1 Enabled - LTR Enabled
[    2.253009] iwlwifi 0000:03:00.0: L1 Enabled - LTR Enabled
[    2.662203] iwlwifi 0000:03:00.0: L1 Enabled - LTR Enabled
[    2.662411] iwlwifi 0000:03:00.0: L1 Enabled - LTR Enabled
[    2.735352] iwlwifi 0000:03:00.0: L1 Enabled - LTR Enabled
[    2.735554] iwlwifi 0000:03:00.0: L1 Enabled - LTR Enabled
[  153.625312] iwlwifi 0000:03:00.0: L1 Enabled - LTR Enabled
[  153.625511] iwlwifi 0000:03:00.0: L1 Enabled - LTR Enabled
[  153.694826] iwlwifi 0000:03:00.0: L1 Enabled - LTR Enabled
[  153.695024] iwlwifi 0000:03:00.0: L1 Enabled - LTR Enabled
[  180.480855] iwlwifi 0000:03:00.0: L1 Enabled - LTR Enabled
[  180.481054] iwlwifi 0000:03:00.0: L1 Enabled - LTR Enabled
[  180.550694] iwlwifi 0000:03:00.0: L1 Enabled - LTR Enabled
[  180.550891] iwlwifi 0000:03:00.0: L1 Enabled - LTR Enabled
[  395.172489] iwlwifi 0000:03:00.0: Microcode SW error detected.  Restarting 0x82000000.
[  395.178239] iwlwifi 0000:03:00.0: CSR values:
[  395.179525] iwlwifi 0000:03:00.0: (2nd byte of CSR_INT_COALESCING is CSR_INT_PERIODIC_REG)
[  395.180776] iwlwifi 0000:03:00.0:        CSR_HW_IF_CONFIG_REG: 0X00489200
[  395.182043] iwlwifi 0000:03:00.0:          CSR_INT_COALESCING: 0X0000ff40
[  395.183274] iwlwifi 0000:03:00.0:                     CSR_INT: 0X10000000
[  395.184485] iwlwifi 0000:03:00.0:                CSR_INT_MASK: 0X00000000
[  395.185619] iwlwifi 0000:03:00.0:           CSR_FH_INT_STATUS: 0X00000000
[  395.186715] iwlwifi 0000:03:00.0:                 CSR_GPIO_IN: 0X00000000
[  395.187830] iwlwifi 0000:03:00.0:                   CSR_RESET: 0X00000000
[  395.188924] iwlwifi 0000:03:00.0:                CSR_GP_CNTRL: 0X080403c5
[  395.190031] iwlwifi 0000:03:00.0:                  CSR_HW_REV: 0X00000210
[  395.191129] iwlwifi 0000:03:00.0:              CSR_EEPROM_REG: 0Xd55555d5
[  395.192230] iwlwifi 0000:03:00.0:               CSR_EEPROM_GP: 0X00000000
[  395.193331] iwlwifi 0000:03:00.0:              CSR_OTP_GP_REG: 0Xd55555d5
[  395.194420] iwlwifi 0000:03:00.0:                 CSR_GIO_REG: 0X001f0042
[  395.195517] iwlwifi 0000:03:00.0:            CSR_GP_UCODE_REG: 0X00000000
[  395.196651] iwlwifi 0000:03:00.0:           CSR_GP_DRIVER_REG: 0X00000000
[  395.197798] iwlwifi 0000:03:00.0:           CSR_UCODE_DRV_GP1: 0X00000000
[  395.198910] iwlwifi 0000:03:00.0:           CSR_UCODE_DRV_GP2: 0X00000000
[  395.200011] iwlwifi 0000:03:00.0:                 CSR_LED_REG: 0X00000060
[  395.201118] iwlwifi 0000:03:00.0:        CSR_DRAM_INT_TBL_REG: 0X88372316
[  395.202249] iwlwifi 0000:03:00.0:        CSR_GIO_CHICKEN_BITS: 0X27800200
[  395.203310] iwlwifi 0000:03:00.0:             CSR_ANA_PLL_CFG: 0Xd55555d5
[  395.204367] iwlwifi 0000:03:00.0:      CSR_MONITOR_STATUS_REG: 0Xc3b7ff57
[  395.205410] iwlwifi 0000:03:00.0:           CSR_HW_REV_WA_REG: 0X0001001a
[  395.206455] iwlwifi 0000:03:00.0:        CSR_DBG_HPET_MEM_REG: 0Xffff0000
[  395.207507] iwlwifi 0000:03:00.0: FH register values:
[  395.208562] iwlwifi 0000:03:00.0:         FH_RSCSR_CHNL0_STTS_WPTR_REG: 0X37185700
[  395.209630] iwlwifi 0000:03:00.0:        FH_RSCSR_CHNL0_RBDCB_BASE_REG: 0X03718560
[  395.210662] iwlwifi 0000:03:00.0:                  FH_RSCSR_CHNL0_WPTR: 0X00000078
[  395.211751] iwlwifi 0000:03:00.0:         FH_MEM_RCSR_CHNL0_CONFIG_REG: 0X00801114
[  395.212807] iwlwifi 0000:03:00.0:          FH_MEM_RSSR_SHARED_CTRL_REG: 0X000000fc
[  395.213829] iwlwifi 0000:03:00.0:            FH_MEM_RSSR_RX_STATUS_REG: 0X02070000
[  395.214816] iwlwifi 0000:03:00.0:    FH_MEM_RSSR_RX_ENABLE_ERR_IRQ2DRV: 0X00000000
[  395.215784] iwlwifi 0000:03:00.0:                FH_TSSR_TX_STATUS_REG: 0X07ff0001
[  395.216734] iwlwifi 0000:03:00.0:                 FH_TSSR_TX_ERROR_REG: 0X00000000
[  395.217788] iwlwifi 0000:03:00.0: Start IWL Error Log Dump:
[  395.218744] iwlwifi 0000:03:00.0: Status: 0x00000000, count: 6
[  395.219695] iwlwifi 0000:03:00.0: Loaded firmware version: 22.361476.0
[  395.220654] iwlwifi 0000:03:00.0: 0x0000000C | ADVANCED_SYSASSERT          
[  395.221601] iwlwifi 0000:03:00.0: 0x000002F0 | trm_hw_status0
[  395.222526] iwlwifi 0000:03:00.0: 0x00000000 | trm_hw_status1
[  395.223425] iwlwifi 0000:03:00.0: 0x00043850 | branchlink2
[  395.224326] iwlwifi 0000:03:00.0: 0x0004A5E8 | interruptlink1
[  395.225224] iwlwifi 0000:03:00.0: 0x0000010C | interruptlink2
[  395.226142] iwlwifi 0000:03:00.0: 0x00000000 | data1
[  395.227023] iwlwifi 0000:03:00.0: 0x00000020 | data2
[  395.227900] iwlwifi 0000:03:00.0: 0x02079842 | data3
[  395.228778] iwlwifi 0000:03:00.0: 0x00000000 | beacon time
[  395.229638] iwlwifi 0000:03:00.0: 0x0CCAB5C1 | tsf low
[  395.230467] iwlwifi 0000:03:00.0: 0x00000000 | tsf hi
[  395.231283] iwlwifi 0000:03:00.0: 0x00000000 | time gp1
[  395.232075] iwlwifi 0000:03:00.0: 0x0CCAB5C2 | time gp2
[  395.232843] iwlwifi 0000:03:00.0: 0x00000000 | uCode revision type
[  395.233595] iwlwifi 0000:03:00.0: 0x00000016 | uCode version major
[  395.234296] iwlwifi 0000:03:00.0: 0x00058404 | uCode version minor
[  395.234992] iwlwifi 0000:03:00.0: 0x00000210 | hw version
[  395.235705] iwlwifi 0000:03:00.0: 0x00489200 | board version
[  395.236388] iwlwifi 0000:03:00.0: 0x00FF001C | hcmd
[  395.237025] iwlwifi 0000:03:00.0: 0x27E62000 | isr0
[  395.237658] iwlwifi 0000:03:00.0: 0x01000000 | isr1
[  395.238283] iwlwifi 0000:03:00.0: 0x00000002 | isr2
[  395.238882] iwlwifi 0000:03:00.0: 0x40417C80 | isr3
[  395.239433] iwlwifi 0000:03:00.0: 0x00000000 | isr4
[  395.239984] iwlwifi 0000:03:00.0: 0x10800112 | last cmd Id
[  395.240503] iwlwifi 0000:03:00.0: 0x00000000 | wait_event
[  395.241037] iwlwifi 0000:03:00.0: 0x00005008 | l2p_control
[  395.241553] iwlwifi 0000:03:00.0: 0x00001420 | l2p_duration
[  395.242033] iwlwifi 0000:03:00.0: 0x00000000 | l2p_mhvalid
[  395.242512] iwlwifi 0000:03:00.0: 0x00000000 | l2p_addr_match
[  395.242992] iwlwifi 0000:03:00.0: 0x00000005 | lmpm_pmg_sel
[  395.243470] iwlwifi 0000:03:00.0: 0x03071928 | timestamp
[  395.243937] iwlwifi 0000:03:00.0: 0x0F807888 | flow_handler
[  395.515575] iwlwifi 0000:03:00.0: L1 Enabled - LTR Enabled
[  395.515771] iwlwifi 0000:03:00.0: L1 Enabled - LTR Enabled
[  395.585488] iwlwifi 0000:03:00.0: L1 Enabled - LTR Enabled
[  395.585686] iwlwifi 0000:03:00.0: L1 Enabled - LTR Enabled

Offline

Board footer

Powered by FluxBB