0001 .. SPDX-License-Identifier: GPL-2.0
0002
0003 =========================================
0004 How to use packet injection with mac80211
0005 =========================================
0006
0007 mac80211 now allows arbitrary packets to be injected down any Monitor Mode
0008 interface from userland. The packet you inject needs to be composed in the
0009 following format::
0010
0011 [ radiotap header ]
0012 [ ieee80211 header ]
0013 [ payload ]
0014
0015 The radiotap format is discussed in
0016 ./Documentation/networking/radiotap-headers.rst.
0017
0018 Despite many radiotap parameters being currently defined, most only make sense
0019 to appear on received packets. The following information is parsed from the
0020 radiotap headers and used to control injection:
0021
0022 * IEEE80211_RADIOTAP_FLAGS
0023
0024 ========================= ===========================================
0025 IEEE80211_RADIOTAP_F_FCS FCS will be removed and recalculated
0026 IEEE80211_RADIOTAP_F_WEP frame will be encrypted if key available
0027 IEEE80211_RADIOTAP_F_FRAG frame will be fragmented if longer than the
0028 current fragmentation threshold.
0029 ========================= ===========================================
0030
0031 * IEEE80211_RADIOTAP_TX_FLAGS
0032
0033 ============================= ========================================
0034 IEEE80211_RADIOTAP_F_TX_NOACK frame should be sent without waiting for
0035 an ACK even if it is a unicast frame
0036 ============================= ========================================
0037
0038 * IEEE80211_RADIOTAP_RATE
0039
0040 legacy rate for the transmission (only for devices without own rate control)
0041
0042 * IEEE80211_RADIOTAP_MCS
0043
0044 HT rate for the transmission (only for devices without own rate control).
0045 Also some flags are parsed
0046
0047 ============================ ========================
0048 IEEE80211_RADIOTAP_MCS_SGI use short guard interval
0049 IEEE80211_RADIOTAP_MCS_BW_40 send in HT40 mode
0050 ============================ ========================
0051
0052 * IEEE80211_RADIOTAP_DATA_RETRIES
0053
0054 number of retries when either IEEE80211_RADIOTAP_RATE or
0055 IEEE80211_RADIOTAP_MCS was used
0056
0057 * IEEE80211_RADIOTAP_VHT
0058
0059 VHT mcs and number of streams used in the transmission (only for devices
0060 without own rate control). Also other fields are parsed
0061
0062 flags field
0063 IEEE80211_RADIOTAP_VHT_FLAG_SGI: use short guard interval
0064
0065 bandwidth field
0066 * 1: send using 40MHz channel width
0067 * 4: send using 80MHz channel width
0068 * 11: send using 160MHz channel width
0069
0070 The injection code can also skip all other currently defined radiotap fields
0071 facilitating replay of captured radiotap headers directly.
0072
0073 Here is an example valid radiotap header defining some parameters::
0074
0075 0x00, 0x00, // <-- radiotap version
0076 0x0b, 0x00, // <- radiotap header length
0077 0x04, 0x0c, 0x00, 0x00, // <-- bitmap
0078 0x6c, // <-- rate
0079 0x0c, //<-- tx power
0080 0x01 //<-- antenna
0081
0082 The ieee80211 header follows immediately afterwards, looking for example like
0083 this::
0084
0085 0x08, 0x01, 0x00, 0x00,
0086 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0087 0x13, 0x22, 0x33, 0x44, 0x55, 0x66,
0088 0x13, 0x22, 0x33, 0x44, 0x55, 0x66,
0089 0x10, 0x86
0090
0091 Then lastly there is the payload.
0092
0093 After composing the packet contents, it is sent by send()-ing it to a logical
0094 mac80211 interface that is in Monitor mode. Libpcap can also be used,
0095 (which is easier than doing the work to bind the socket to the right
0096 interface), along the following lines:::
0097
0098 ppcap = pcap_open_live(szInterfaceName, 800, 1, 20, szErrbuf);
0099 ...
0100 r = pcap_inject(ppcap, u8aSendBuffer, nLength);
0101
0102 You can also find a link to a complete inject application here:
0103
0104 https://wireless.wiki.kernel.org/en/users/Documentation/packetspammer
0105
0106 Andy Green <andy@warmcat.com>
