Kismet
Der Aspire One braucht den madwifi-Treiber.
kismet muss als madwifi_g konfiguriert werden: /etc/kismet/kismet.conf:
source=madwifi_g,wifi0,madwifi
(madwifi_g, nicht madwifi_ng)
Problem: unter iwconfig findet man ath0. Kismet braucht aber beim madwifi_ng aber wifi0
Zum Anlegen eines ath0 im Monitor-Mode würde ich folgendes empfehlen:
ifconfig ath0 down wlanconfig ath0 destroy wlanconfig ath0 create wlandev wifi0 wlanmode monitor ifconfig ath0 up
airmon-ng geht auch:
It depends on which driver you are using. For all drivers except madwifi-ng: airmon-ng stop <interface name> For madwifi-ng, first stop ALL interfaces: airmon-ng stop athX Where X is 0, 1, 2 etc. Do a stop for each interface that iwconfig lists. Then: wlanconfig ath create wlandev wifi0 wlanmode sta
kismet -c madwifi_g,wifi0,madwifi
Sources:
Source type Cards OS Driver --------------- ------------------- ----------- ------------------------- acx100 TI ACX100 Linux ACX100 http://acx100.sourceforge.net/ ACX100 drivers handle the 22mbit cards branded by D-Link and others. admtek ADMTek Linux ADMTek http://www.latinsud.com/adm8211/ (Patches) http://aluminum.sourmilk.net/adm8211/ (GPL driver) ADMTek drivers used in many consumer 802.11b cards. With the patches above, quasi-rfmon is possible - these cards appear to be almost entirely software controlled and always in a rfmon-like state. This card WILL BROADCAST while in rfmon, rendering the sniffer visible. The fully GPL drivers are supported, in addition to the hacks to the non-free drivers. airpcap Airpcap USB cygwin CACE Tech http://www.cacetech.com/products/airpcap.htm The CACE AirPcap USB device allows native capture on Win32/Cygwin. The explicit airpcap source expects the Win32/Cygwin interface name. This should be used once the source is identified via airpcap_ask or if multiple simultaneous sources are required. airpcap_ask Airpcap USB cygwin CACE Tech http://www.cacetech.com/products/airpcap.htm The CACE AirPcap USB device allows native capture on Win32/Cygwin. The airpcap_ask source lists available airpcap devices and allows the user to pick interactively. The 'capture interface' field is irrelevant and can be filled with any value (for example, 'dummy') atmel_usb Atmel-USB Linux Berlios-Atmel http://at76c503a.berlios.de/ These drivers work ONLY on USB cards (Sorry, no PCMCIA support). Monitor mode support is limited and "faked" by bypassing part of the firmware and parsing packets directly, and is likely to not report all of the frames. This card MAY BROADCAST while in rfmon, rendering the sniffer visible. It appears that this card may be only formatting the beacons as an 802.11 stream, which means you likely will not see data frames, rendering most IDS functions, IP discovery, and data logging unavailable. ath5k Atheros Linux Kernel/Madwifi http://madwifi.org Based on the OpenBSD OpenHAL, the Ath5k drivers are the future of Atheros support and will be mainlined into the Linux kernel. ath5k_a Atheros Linux Kernel/Madwifi http://madwifi.org Ath5k source for 11a only ath5k_ag Atheros Linux Kernel/Madwifi http://madwifi.org Ath5k source for 11a/11g bcm43xx Broadcom Linux BCM43XX http://bcm43xx.berlios.de, kernel Linux native broadcom drivers incorporated into modern kernels. b43 Broadcom Linux B43 broadcom drivers for current Broadcom devices in Linux kernels b43legacy Broadcom Linux B43 broadcom drivers for legacy Broadcom devices in Linux kernels cisco Aironet 340,350 Linux Kernel 2.4.10 - 2.4.19 Standard Cisco cards in Linux. Works only with the Linux kernel drivers, not the drivers found in pcmcia-cs. The drivers found on the cisco.com site can be patched with the files from the Kismet download site to add monitor mode with channel control, HOWEVER these drivers are extremely buggy for normal use and work only with the 2.4 kernel tree. The cisco drivers currently do not enter rfmon mode correctly, so channel control is not available. The firmware will hop to whatever channel it feels like hopping to, when it feels like hopping. cisco_wifix Aironet 340,350 Linux Kernel 2.4.20+, CVS http://sourceforge.net/projects/airo-linux/ Capture interface: 'ethX:wifiX' Kernel 2.4.20+ and CVS drivers use ethX for normal mode and wifiX for monitor mode. Kismet needs to know both devices, which may not necessarily be the same number, for example 'eth1:wifi0'. Linux kernel 2.4.20 and 2.4.21 have highly unstable cisco drivers and should be avoided. The cisco drivers currently do not enter rfmon mode correctly, so channel control is not available. The firmware will hop to whatever channel it feels like hopping to, when it feels like hopping. darwin OSX native cards OSX/Darwin OSX Supports both Broadcom and Atheros Airport-Extreme cards. When using a Broadcom based card, it may be necessary to enable rfmon on the device for the first time using another program. When using an Atheros based card, 802.11a may also be supported by adding a 'sourcechannels' line to kismet.conf. hostap Prism/2 Linux HostAP 0.4 http://hostap.epitest.fi/ HostAP drivers drive the Prism/2 chipset in access point mode, but also can drive the cards in client and monitor modes. The HostAP drivers seem to change how they go into monitor mode fairly often, but this source should manage to get them going. ipw2100 Intel/Centrino Linux ipw2100-0.44+ http://ipw2100.sourceforge.net/ The Linux IPW2100/Centrino drivers for 802.11b cards now support rfmon, so here's support for them. They act more or less like any other wireless interface would. ipw2200 Intel/Centrino Linux ipw2200-1.0.4+ http://ipw2200.sourceforge.net/ The Linux IPW2200/Centrino drivers for 802.11bg cards support rfmon as of 1.0.4 and firmware 2.3. Signal level reporting requires radiotap be turned on in the makefile while compiling the driver. Noise levels are not reported. ipw2915 Intel/Centrino Linux ipw2200-1.0.4+ http://ipw2200.sourceforge.net/ The Linux IPW2200/Centrino drivers for 802.11bga cards support rfmon as of 1.0.4 and firmware 2.3. This is the same as ipw2200 but defaults to scanning the 802.11a channel range in addition to 802.11b/g. Signal level reporting requires radiotap be turned on in the makefile while compiling the driver. Noise levels are not reported. ipw3945 Intel/Centrino Linux ipw3945 http://ipw3945.sourceforge.net/ The Linux IPW3945/Centrino drivers for Intel Core 802.11bga cards. ipwlivetap Intel/Centrino Linux ipw2200/3945 http://ipw2200.sourceforge.net/ http://ipw3945.sourceforge.net/ The ipw3945 and patched ipw2200 drivers support a special mode which allows monitor-mode style sniffing while remaining associated. Channel hopping is not possible, as the card is still associated to a specific AP, but single-channel IDS and sniffing can be accomplished. See the ipw driver mailing list archives for information about patching your drivers. iwl3945 Intel/Centrino Linux iwl3945 Intel's new IPW drivers using the mac80211 kernel layer. iwl4965 Intel/Centrino Linux iwl4965 Intel's new IPW drivers using the mac80211 kernel layer. kismet_drone n/a Any n/a Capture interface: 'dronehost:port' The remote drone capture source connects to a Kismet drone and processes the packets. Refer to the Remote Drone section of the README for more details about how to set up a drone. madwifi_a Atheros Linux madwifi http://sourceforge.net/projects/madwifi/ Capture interface: 'athX' Capture interface: 'wifiX' (Madwifi-NG) Madwifi drivers in 802.11a-only mode. When using madwifi-ng, be sure all non-monitor VAPs have been removed, otherwise madwifi will not properly report most traffic. madwifi_b Atheros Linux madwifi http://sourceforge.net/projects/madwifi/ Capture interface: 'athX' Capture interface: 'wifiX' (Madwifi-NG) Madwifi drivers in 802.11b-only mode. When using madwifi-ng, be sure all non-monitor VAPs have been removed, otherwise madwifi will not properly report most traffic. madwifi_g Atheros Linux madwifi http://sourceforge.net/projects/madwifi/ Capture interface: 'athX' Capture interface: 'wifiX' (Madwifi-NG) Madwifi drivers in 802.11g-only mode. This will, obviously, also see 11b networks. When using madwifi-ng, be sure all non-monitor VAPs have been removed, otherwise madwifi will not properly report most traffic. madwifi_ab Atheros Linux madwifi http://sourceforge.net/projects/madwifi/ Capture interface: 'athX' Capture interface: 'wifiX' (Madwifi-NG) Madwifi drivers in 802.11a and 802.11b combo mode. This will seamlessly switch between bands during channel hopping. When using madwifi-ng, be sure all non-monitor VAPs have been removed, otherwise madwifi will not properly report most traffic. madwifi_ag Atheros Linux madwifi http://sourceforge.net/projects/madwifi/ Capture interface: 'athX' Capture interface: 'wifiX' (Madwifi-NG) Madwifi drivers in 802.11a and 802.11g combo mode. This will seamlessly switch between bands during channel hopping. When using madwifi-ng, be sure all non-monitor VAPs have been removed, otherwise madwifi will not properly report most traffic. madwifing_a Atheros Linux madwifi-ng madwifing_ab Atheros Linux madwifi-ng madwifing_ag Atheros Linux madwifi-ng madwifing_g Atheros Linux madwifi-ng madwifing_b Atheros Linux madwifi-ng http://sourceforge.net/projects/madwifi/ Capture interface: 'wifiX' *Deprecated*. Detection for madwifi-ng is built into the standard madwifi sources. The _ng source names have been kept to allow old configs to continue functioning. nokia770 Nokia Linux Nokiea http://maemo.org/ Nokia770 capture interface. Includes support for validating frame checksums to screen out junk packets, since the drivers pass us all data. nokia8x0 Nokia 800,810 http://maemo.org/ Nokia 8x0 capture interface, including support for FCS validation. The Nokia drivers appear to exhibit instability while capturing where they stop reporting packets. This may be minimized by setting the Network Scan interval to "never" in the control panel->networking section. orinoco Lucent, Orinoco Linux Patched orinoco_cs http://airsnort.shmoo.com/orinocoinfo.html The Orinoco drivers which have mainlined into the Linux kernel do support monitor mode, however only specific firmware versions are supported and often they do not work. An up-ported version of the older Orinoco drivers which more reliably supported rfmon may be available at: http://www.projectiwear.org/~plasmahh/orinoco.html Generally, Orinoco cards are not recommended for use with Kismet due to these limitations. orinoco_14 Lucent, Orinoco Linux Orinoco 0.14+ https://savannah.nongnu.org/projects/orinoco/ This source is deprecated and should only be used with pre-release versions of a driver since merged into the Linux kernel. pcapfile n/a Any n/a Capture interface: '/path/to/file' The pcapfile capture source feeds a stored 802.11-encap dump file through the Kismet engine again. This can be useful for debugging or rescanning old logs for alert conditions. Pcapfile sources are only available if Kismet was compiled with libpcap support. prism2_openbsd Prism/2 OpenBSD Kernel Full support for Prism2 under OpenBSD. prism54g PrismGT Linux prism54 http://www.prism54.org PrismGT 802.11g drivers supporting monitor mode. radiotap_bsd_ab Radiotap BSD Kernel Dual-band cards with radiotap headers. radiotap_bsd_a Radiotap BSD Kernel 802.11a cards (or dual-band on 11a channels only) with radiotap headers. radiotap_bsd_b Radiotap BSD Kernel 802.11b/g cards (or dual-band on 11b channels only) with radiotap headers. rt2400 Ralink 2400 11b Linux rt2400-gpl http://rt2x00.serialmonkey.com/ Ralink 2400 802.11b cards using the serialmonkey GPL'd rt2x00 drivers. Must use 1.2.2 beta 2 or newer drivers. rt2500 Ralink 2500 11g Linux rt2500-gpl http://rt2x00.serialmonkey.com/ Ralink 2500 802.11g cards using the serialmonkey GPL'd rt2x00 drivers. Must use 1.1.0 beta 2 or newer drivers. rt73 Ralink 73 11g Linux rt73-gpl-cvs http://rt2x00.serialmonkey.com/ Ralink 73 802.11g USB cards using the serialmonkey GPL'd rt79 drivers (tested only with CVS driver versions) rt8180 Realtek 8180 11b Linux rtl8180-sa2400 http://rtl8180-sa2400.sourceforge.net/ Realtek 8180 based cards (there seem to be an awful lot of them) using the GPL drivers. viha Airport OSX viha http://www.dopesquad.net/security/ Monitor mode support for Airport under OSX. Does not support Airport Extreme. vtar5k Atheros 802.11a Linux vtar5k http://team.vantronix.net/ar5k/ vtar5k drivers handle some Atheros 802.11a cards. Chances are you'll have better luck with madwifi drivers. wlanng_legacy Prism/2 Linux wlan-ng 0.1.3 and earlier http://www.linux-wlan.com/ Old wlan-ng drivers didn't support pcap capturing and use a netlink socket to the kernel. These are still in use on some embedded systems (like the Zaurus). wlanng Prism/2 Linux wlan-ng 0.1.4 - 0.1.9 http://www.linux-wlan.com/ Wlan-ng prism2 drivers prior to the AVS headers. wlanng_avs Prism/2 Linux wlan-ng 0.2.0+ http://www.linux-wlan.com/ Newer wlan-ng drivers support a new header type and slightly different monitor commands to report wepped packets. wrt54g Linksys WRT54G Linux linksys http://seattlewireless.net/index.cgi/LinksysWrt54g Capture interface: 'wlX' Support for the newer firmware versions on the WRT54G/S/L devices (and any others using the broadcom reference chipset). Some systems generate a secondary device, prism0, while in monitor mode and require special care while channel hopping, it is no longer necessary to specify the prism0 device explicitly for Kismet. wsp100 NetChem WSP100 Any n/a http://networkchemistry.com/ Capture interface: 'host:port' The WSP100 is an embedded device which reports 802.11 packets over UDP. The wsp100 capture source is (generally) system agnostic, however over time it has been less maintained than others. If you'd like to send me patches for this, please let me know. zd1211 ZyDAS USB Linux zd1211 http://zd1211.ath.cx The ZD1211 drivers have had some regressions which lead to data corruption while changing channel. Some versions work, and typically the aircrack patches resolve the corruption issues if your version doesn't properly handle rfmon. Chipsets known to NOT WORK: Broadcom - No linux drivers, only useable with ndiswrapper or linuxant wrappers around windows drivers. *** UPDATE *** See the bcm43xx source type entry. There are experimental reverse-engineered drivers which have monitor mode support now under Linux! If they don't work, however, then too bad. Airport Extreme - Really a Broadcom, with no rfmon in the OSX drivers. *** UPDATE *** See the bcm source for linux on ppc, it MAY work, it may not. Currently theres no solution for OSX but I'm looking for OSX hackers interested in redoing the Kismet port and looking into adding more support. Atmel - There is a hack for pseudo-monitor in USB. There is currently no equivalent hack for PCMCIA. HermesII - Proxim successor to the Orinoco/HermesI. No support yet in the drivers, may be available in the future. ndiswrapper - Anything using ndiswrapper is using WINDOWS drivers AND CAN NOT BE USED WITH KISMET.
