Root/Documentation/networking/mac80211-injection.txt

1How to use packet injection with mac80211
2=========================================
3
4mac80211 now allows arbitrary packets to be injected down any Monitor Mode
5interface from userland. The packet you inject needs to be composed in the
6following format:
7
8 [ radiotap header ]
9 [ ieee80211 header ]
10 [ payload ]
11
12The radiotap format is discussed in
13./Documentation/networking/radiotap-headers.txt.
14
15Despite many radiotap parameters being currently defined, most only make sense
16to appear on received packets. The following information is parsed from the
17radiotap headers and used to control injection:
18
19 * IEEE80211_RADIOTAP_FLAGS
20
21   IEEE80211_RADIOTAP_F_FCS: FCS will be removed and recalculated
22   IEEE80211_RADIOTAP_F_WEP: frame will be encrypted if key available
23   IEEE80211_RADIOTAP_F_FRAG: frame will be fragmented if longer than the
24                  current fragmentation threshold.
25
26
27The injection code can also skip all other currently defined radiotap fields
28facilitating replay of captured radiotap headers directly.
29
30Here is an example valid radiotap header defining some parameters
31
32    0x00, 0x00, // <-- radiotap version
33    0x0b, 0x00, // <- radiotap header length
34    0x04, 0x0c, 0x00, 0x00, // <-- bitmap
35    0x6c, // <-- rate
36    0x0c, //<-- tx power
37    0x01 //<-- antenna
38
39The ieee80211 header follows immediately afterwards, looking for example like
40this:
41
42    0x08, 0x01, 0x00, 0x00,
43    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
44    0x13, 0x22, 0x33, 0x44, 0x55, 0x66,
45    0x13, 0x22, 0x33, 0x44, 0x55, 0x66,
46    0x10, 0x86
47
48Then lastly there is the payload.
49
50After composing the packet contents, it is sent by send()-ing it to a logical
51mac80211 interface that is in Monitor mode. Libpcap can also be used,
52(which is easier than doing the work to bind the socket to the right
53interface), along the following lines:
54
55    ppcap = pcap_open_live(szInterfaceName, 800, 1, 20, szErrbuf);
56...
57    r = pcap_inject(ppcap, u8aSendBuffer, nLength);
58
59You can also find a link to a complete inject application here:
60
61http://wireless.kernel.org/en/users/Documentation/packetspammer
62
63Andy Green <andy@warmcat.com>
64

Archive Download this file



interactive