Skip to contentSkip to conversation

Frame Injection with NL80211_CMD_FRAME is failing (SOLVED)

DISCUSSION Hakan Coşkun 1 participant 1 message Oct 17, 2014

lore
Share & tools
lore
#0 lore raw

Hi all,

I found the problem. There is a check in /net/mac80211/cfg.c

!rcu_access_pointer(sdata->bss->beacon))

I guess this related to beaconing. If it is not configured, off-channel is required in any case.

If you put the interface into AP mode and try to send frames with NL80211_CMD_FRAME you have to set the OFFCHANNEL_TX_OK flag in any case !!!

Right now I am facing the problem of not getting probe-requests delivered to my master mode interface through NL80211_CMD_REGISTER_FRAME. It works only if I start an additional monitor interface on the same card. Any clue what to do to enable frame delivery to the AP interface without a monitor interface.

Kind Regards,
Hakan

Am 03.10.14 12:04 schrieb "Hakan Coşkun" unter <[email protected]>:

Quoted 27 lines

Hi,

For some time I am playing around with tools like scapy, senf, lorcon etc. Which allow to receive and construct frames in user-space and send them with
pcap or raw sockets. I am trying to achieve the injection part with NL80211_CMD_FRAME. According to the description, only management frames are
supported by this command. Am I right ?

I put some printks into nl80211.c and mlme.c to follow the transmission part
and to understand where my commands are failing.
I¹ve put my interface into master mode (NL80211_IFTYPE_AP) in order pass the
checks in cfg80211. When I try to send down a beacon frame or another management frame I got an error from cfg80211_mlme_mgmt_tx in mlme.c. rdev_mgmt_tx returns an error code. How can I figure out why my frame is not
send down on the wiphy ?

By the way, why is CMD_FRAME only restricted to management frames ?

Regards,
Hakan