Arch Linux

tiredofit

Member

Registered: 2015-08-21

Posts: 3

Can't get Wireless network cards in Monitor Mode

I'm having quite the problem getting my wireless network cards into Monitor mode.

I have an onboard Intel 7260, and also an external RTL8187.

I run a custom compiled kernel, but have also tried with 4.1.5 and 3.14-lts from the repositories.

I've downloaded backports-patched and backports-patched-git from the AUR and have chosen defconfig-wifi.

Modules compile properly and package installs correctly, and I've also rebuilt my initramfs. Still, after reboot, I cannot force any of these cards into Monitor mode, no matter what Kernel I have tried. I've moved over from Ubuntu approximately 5 months ago and this is the final piece that I struggle with, and am now getting into a situation where I require monitor mode for analsysis.
It appears the modules are indeed loading.

[root@nomad dave]# modinfo rtlwifi
filename:       /lib/modules/4.1.6/updates/drivers/net/wireless/rtlwifi/rtlwifi.ko
version:        backported from Linux (v4.1.1-0-g6a010c0) using backports v4.1.1-1-0-g8286954
description:    Realtek 802.11n PCI wireless core
license:        GPL
author:         Larry Finger	<Larry.FInger@lwfinger.net>
author:         Realtek WlanFAE	<wlanfae@realtek.com>
author:         lizhaoming	<chaoming_li@realsil.com.cn>
srcversion:     B6420B781E0D8DB92A944C0
depends:        mac80211,compat,cfg80211
vermagic:       4.1.6 SMP preempt mod_unload modversions 
[root@nomad dave]# modinfo iwlwifi
filename:       /lib/modules/4.1.6/updates/drivers/net/wireless/iwlwifi/iwlwifi.ko
version:        backported from Linux (v4.1.1-0-g6a010c0) using backports v4.1.1-1-0-g8286954
license:        GPL
author:         Copyright(c) 2003- 2015 Intel Corporation <ilw@linux.intel.com>
description:    Intel(R) Wireless WiFi driver for Linux

Am I missing anything?

Last edited by tiredofit (2015-08-21 16:41:15)

Techmeology

Member

Registered: 2012-08-21

Posts: 19

Re: Can't get Wireless network cards in Monitor Mode

What command are you using to try to get the card into monitor mode? Do you see anything interesting if you run

dmesg

?

Last edited by Techmeology (2015-08-23 13:34:46)

tiredofit

Member

Registered: 2015-08-21

Posts: 3

Re: Can't get Wireless network cards in Monitor Mode

Thanks for reply.

I've tried using a variety of tools (airoscript-ng, wifite, wireshark, wi-feye, gerix, with little to no output occuring. When trying these tools this is the following output:

Aug 24 13:31:56 nomad kernel: usb 1-3: new high-speed USB device number 6 using xhci_hcd
Aug 24 13:31:56 nomad mtp-probe[5370]: checking bus 1, device 6: "/sys/devices/pci0000:00/0000:00:14.0/usb1/1-3"
Aug 24 13:31:56 nomad mtp-probe[5370]: bus: 1, device: 6 was not an MTP device
Aug 24 13:31:57 nomad NetworkManager[658]: <info>  (wlan0): using nl80211 for WiFi device control
Aug 24 13:31:57 nomad kernel: ieee80211 phy1: Selected rate control algorithm 'minstrel_ht'
Aug 24 13:31:57 nomad kernel: ieee80211 phy1: hwaddr 00:XX:4c:9c:XX:XX, RTL8187vB (default) V1 + rtl8225z2, rfkill mask 2
Aug 24 13:31:57 nomad NetworkManager[658]: <info>  (wlan0): new 802.11 WiFi device (carrier: UNKNOWN, driver: 'rtl8187', ifindex: 3)
Aug 24 13:31:57 nomad kernel: rtl8187: Customer ID is 0x00
Aug 24 13:31:57 nomad kernel: rtl8187: wireless switch is on
Aug 24 13:31:57 nomad kernel: usbcore: registered new interface driver rtl8187
Aug 24 13:31:57 nomad NetworkManager[658]: <info>  rfkill4: found WiFi radio killswitch (at /sys/devices/pci0000:00/0000:00:14.0/usb1/1-3/1-3:1.0/ieee80211/phy1/rfkill4) (driver rtl8187)
Aug 24 13:31:57 nomad kernel: rtl8187 1-3:1.0 wlp0s20u3: renamed from wlan0
Aug 24 13:31:57 nomad NetworkManager[658]: <info>  (wlan0): interface index 3 renamed iface from 'wlan0' to 'wlp0s20u3'
Aug 24 13:31:57 nomad NetworkManager[658]: <info>  (wlp0s20u3): device state change: unmanaged -> unavailable (reason 'managed') [10 20 2]
Aug 24 13:31:59 nomad NetworkManager[658]: <info>  (wlp0s20u3) supports 4 scan SSIDs
Aug 24 13:31:59 nomad NetworkManager[658]: <info>  (wlp0s20u3): supplicant interface state: starting -> ready
Aug 24 13:31:59 nomad NetworkManager[658]: <info>  (wlp0s20u3): device state change: unavailable -> disconnected (reason 'supplicant-available') [20 30 42]
Aug 24 13:31:59 nomad ModemManager[747]: <info>  Couldn't find support for device at '/sys/devices/pci0000:00/0000:00:14.0/usb1/1-3': not supported by any plugin
Aug 24 13:32:00 nomad NetworkManager[658]: <info>  (wlp0s20u3): supplicant interface state: ready -> inactive
Aug 24 13:32:25 nomad NetworkManager[658]: <info>  (wlp0s20u3mon): using nl80211 for WiFi device control
Aug 24 13:32:25 nomad NetworkManager[658]: <info>  (wlp0s20u3mon): new 802.11 WiFi device (carrier: UNKNOWN, driver: 'rtl8187', ifindex: 4)
Aug 24 13:32:25 nomad NetworkManager[658]: <info>  (wlp0s20u3mon): device state change: unmanaged -> unavailable (reason 'managed') [10 20 2]
Aug 24 13:32:29 nomad NetworkManager[658]: <info>  (wlp0s20u3): supplicant interface state: inactive -> disabled
Aug 24 13:32:29 nomad NetworkManager[658]: <info>  (wlp0s20u3): device state change: disconnected -> unmanaged (reason 'removed') [30 10 36]
Aug 24 13:32:29 nomad NetworkManager[658]: <info>  (wlp0s20u3mon) supports 4 scan SSIDs
Aug 24 13:32:29 nomad NetworkManager[658]: <info>  (wlp0s20u3mon): supplicant interface state: starting -> ready
Aug 24 13:32:29 nomad NetworkManager[658]: <info>  (wlp0s20u3mon): device state change: unavailable -> disconnected (reason 'supplicant-available') [20 30 42]
Aug 24 13:32:31 nomad NetworkManager[658]: <info>  (wlp0s20u3mon): supplicant interface state: ready -> inactive

[21558.423337] usb 1-3: new high-speed USB device number 6 using xhci_hcd
[21559.233262] ieee80211 phy1: Selected rate control algorithm 'minstrel_ht'
[21559.233514] ieee80211 phy1: hwaddr 00:e0:XX:XX:XX:XX, RTL8187vB (default) V1 + rtl8225z2, rfkill mask 2
[21559.243861] rtl8187: Customer ID is 0x00
[21559.245106] rtl8187: wireless switch is on
[21559.245159] usbcore: registered new interface driver rtl8187
[21559.251459] rtl8187 1-3:1.0 wlp0s20u3: renamed from wlan0

As shown it does seem to think it goes into Monitor mode but is actually not.

Using

[root@nomad backports-4.1.1-1]# iwconfig wlp0s20u3 mode monitor
Error for wireless request "Set Mode" (8B06) :
    SET failed on device wlp0s20u3 ; Operation not supported.

Throws this error.

My backports .config is here http://pastebin.com/yEb1AdVT and my actual Kernel .config is http://pastebin.com/HercwzPt

Last edited by tiredofit (2015-08-24 11:57:49)