search
githubEdit

Module 4: Linux Wireless Tools, Drivers, and Stacks

hashtag
Loading and Unloading Wireless Drivers

Determining our wireless device's driver:

kali@kali:~$ sudo airmon-ng

PHY     Interface       Driver          Chipset

phy0    wlan0           ath9k_htc       Qualcomm Atheros Communications AR9271 802.11n

Listing our system's USB devices with detailed information for each one:

kali@kali:~# sudo lsusb -vv

Bus 001 Device 002: ID 0cf3:9271 Qualcomm Atheros Communications AR9271 802.11n
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass          255 Vendor Specific Class
  bDeviceSubClass       255 Vendor Specific Subclass
  bDeviceProtocol       255 Vendor Specific Protocol
  bMaxPacketSize0        64
  idVendor           0x0cf3 Qualcomm Atheros Communications
  idProduct          0x9271 AR9271 802.11n
  bcdDevice            1.08
  iManufacturer          16 ATHEROS
  iProduct               32 USB2.0 WLAN
  iSerial                48 12345
  bNumConfigurations      1
...
circle-info

In Linux, one driver can cover multiple devices, and sometimes multiple similar chipsets. In Windows, each and every piece of hardware needs to have its own driver installed.

Kernel modules often have parameters to adjust settings of the hardware. These settings are displayed with the modinfo command and the name of the driver:

As an example, disabling blinking on network activity on the ath9k_htc driver by resetting the blink parameter when loading the driver:

Linux distributions allow users to set and change parameters for modules using /etc/modprobe.d as well as allows users to blacklist modules. An example case of needing to blacklist a module is an open source and closed source driver being present with both sharing similar IDs. There should only ever be one driver claiming a device at a time, so we blacklist one of them.

lsmod lists all the loaded modules as well as the dependencies of each module.

Before unloading a driver, the module the driver is dependent on must be removed. Attempting to remove a module that has remaining dependencies:

Thus we can use lsmod as a guide to remove modules not needed by other drivers.

circle-info

In the event you are experimenting with drivers, modifying them or compiling drivers, you can use insmod to manually load a module from a specific path; modprobe loads a module from the kernel modules directory. Example: insmod rtl8812au.ko.

hashtag
iwconfig and Other Utilities

Deprecated utilities:

  • iwconfig manipulates the basic wireless parameters: change modes, set channels, and keys.

  • iwlist allows for the initiation of scanning, listing frequencies, bit rates, and encryption keys.

  • iwspy provides per-node link quality (not often implemented by drivers).

  • iwpriv allows for the manipulation of the Wireless Extensions specific to a driver.

Listening the channel numbers and corresponding frequencies our wireless interface is able to detect via iwlist followed by the frequency parameter:

hashtag
The iw Utility

The iw utility with its variety of options is the only command needed for configuring a Wi-Fi device -- assuming the drivers have been loaded properly. Running iw list will provide us with lots of detailed information about the wireless devices and their capabilities:

To get a list of wirless access points within range of our wireless card, use iw with the dev wlan0 option, specifying our wireless interface. Grep for the information wanted:

Creating a new Virtual Interface (VIF) named wlan0mon in monitor mode:

Bringing the new VIF up with ip:

Inspecting our newly created monitor mode interface:

Verifying our card is in monitor mode:

Deleting our VIF:

Central Regulatory Domain Agent (CRDA) helps radios stay compliant with wireless regulations. iw reg interacts with CRDA to query, and in some cases, change it.

Displaying the current regulatory domain:

Using iw reg set is not permanent; to make sure it is always set at boot time, edit /etc/defaults/crda.

hashtag
The rfkill Utility

rfkill is used to enable/disable connected wireless devices. It can be used for Wi-Fi, Bluetooth, mobile broadband, WiMax, GPS, FM, NFC, and any other radio.

Listing all the enabled Wi-Fi and Bluetooth devices on the system:

"Soft blocked" refers to a block from rfkill, done in software. "Hard blocked" refers to a physical switch or BIOS parameter for hte device. rfkill can only change soft blocks.

Disabled a radio:

Confirming our change:

Re-enabling the Wi-Fi device:

Disabling all radios at the same time:

hashtag
Wireless Stacks and Drivers

hashtag
The ieee80211 Wireless Subsystem

Wireless Extension (WE) known as wext is an extension to the Linux networking interface to deal with the specificity of Wi-Fi. It was implemented in three parts:

  1. A set of user tools to control the drivers, with iwconfig, iwlist, iwspy, and iwpriv.

  2. Implementing wext in Wi-Fi drivers to answer actions triggered by wireless tools.

  3. wext required a middle-man to communicate the actions of the different user tools to the drivers and respond back, which is in the kernel.

hashtag
The mac80211 Wireless Framework

Included in all modern Linux kernels, mac80211 standardized most common functions.

mac80211, cfg80211 and nl80211 links

MAC Sublayer Management Entity (MLME) takes care of the following management operations:

  • Authentication

  • Deauthentication

  • Association

  • Disassociation

  • Reassociation

  • Beaconing

PreviousModule 3: Wi-Fi EncryptionNextModule 5: Wireshark Essentials

Last updated