diff --git a/notes/journal/2024-05-08.md b/notes/journal/2024-05-08.md new file mode 100644 index 0000000..c15b7f5 --- /dev/null +++ b/notes/journal/2024-05-08.md @@ -0,0 +1,172 @@ +# Commands to remember + sample output +Used commands: [[nmcli]], [[iw]], [[grep]], [[sed]] +Resources: [Capturing Wireless LAN Packets in Monitor Mode with iw](https://sandilands.info/sgordon/capturing-wifi-in-monitor-mode-with-iw) +Foreign BSSIDs have been made anonymous by replacing with `XX:XX:XX:XX:XX:XX`. +## [[nmcli]] +Useful for getting channel needed to setup monitor mode properly. +### `nmcli dev wifi` +``` +IN-USE BSSID SSID MODE CHAN RATE SIGNAL BARS SECURITY + XX:XX:XX:XX:XX:XX FRITZ!Box 5490 PB Infra 6 195 Mbit/s 75 ▂▄▆_ WPA2 +* 4C:1B:86:D1:06:7B LenbrO Infra 100 540 Mbit/s 67 ▂▄▆_ WPA2 + 4C:1B:86:D1:06:7C LenbrO Infra 6 260 Mbit/s 64 ▂▄▆_ WPA2 + B8:BE:F4:4D:48:17 LenbrO Infra 1 130 Mbit/s 62 ▂▄▆_ WPA + XX:XX:XX:XX:XX:XX -- Infra 6 260 Mbit/s 60 ▂▄▆_ WPA2 + XX:XX:XX:XX:XX:XX FRITZ!Box 5490 PB Infra 60 405 Mbit/s 37 ▂▄__ WPA2 + XX:XX:XX:XX:XX:XX FRITZ!Box Fon WLAN 7360 BP Infra 1 130 Mbit/s 34 ▂▄__ WPA1 WPA2 + XX:XX:XX:XX:XX:XX FRITZ!Box 5490 PB Infra 6 195 Mbit/s 34 ▂▄__ WPA2 + XX:XX:XX:XX:XX:XX Sunrise_Wi-Fi_09FB29 Infra 7 540 Mbit/s 34 ▂▄__ WPA2 WPA3 + XX:XX:XX:XX:XX:XX Madchenband Infra 11 260 Mbit/s 34 ▂▄__ WPA2 + XX:XX:XX:XX:XX:XX LenbrO Infra 36 270 Mbit/s 34 ▂▄__ WPA2 + XX:XX:XX:XX:XX:XX FibreBox_X6-01EF47 Infra 1 260 Mbit/s 32 ▂▄__ WPA2 + XX:XX:XX:XX:XX:XX -- Infra 11 260 Mbit/s 32 ▂▄__ WPA2 + XX:XX:XX:XX:XX:XX EEG-04666 Infra 1 405 Mbit/s 30 ▂___ WPA2 + XX:XX:XX:XX:XX:XX Salt_2GHz_8A9170 Infra 11 260 Mbit/s 29 ▂___ WPA2 + XX:XX:XX:XX:XX:XX -- Infra 11 260 Mbit/s 24 ▂___ WPA2 + XX:XX:XX:XX:XX:XX FRITZ!Box 5490 PB Infra 60 405 Mbit/s 19 ▂___ WPA2 +``` +### `nmcli -t dev wifi` +``` + XX\:XX\:XX\:XX\:XX\:XX:FRITZ!Box 5490 PB:Infra:6:195 Mbit/s:79:▂▄▆_:WPA2 + :XX\:XX\:XX\:XX\:XX\:XX::Infra:6:260 Mbit/s:75:▂▄▆_:WPA2 + :4C\:1B\:86\:D1\:06\:7C:LenbrO:Infra:6:260 Mbit/s:74:▂▄▆_:WPA2 +*:4C\:1B\:86\:D1\:06\:7B:LenbrO:Infra:100:540 Mbit/s:72:▂▄▆_:WPA2 + :B8\:BE\:F4\:4D\:48\:17:LenbrO:Infra:1:130 Mbit/s:65:▂▄▆_:WPA2 + :XX\:XX\:XX\:XX\:XX\:XX:Sunrise_Wi-Fi_09FB29:Infra:7:540 Mbit/s:52:▂▄__:WPA2 WPA3 + :XX\:XX\:XX\:XX\:XX\:XX:FRITZ!Box 5490 PB:Infra:60:405 Mbit/s:50:▂▄__:WPA2 + :XX\:XX\:XX\:XX\:XX\:XX:FRITZ!Box Fon WLAN 7360 BP:Infra:1:130 Mbit/s:47:▂▄__:WPA1 WPA2 + :XX\:XX\:XX\:XX\:XX\:XX:FRITZ!Box 5490 PB:Infra:6:195 Mbit/s:45:▂▄__:WPA2 + :XX\:XX\:XX\:XX\:XX\:XX:Zentrum der Macht:Infra:1:195 Mbit/s:44:▂▄__:WPA2 + :XX\:XX\:XX\:XX\:XX\:XX:FibreBox_X6-01EF47:Infra:1:260 Mbit/s:42:▂▄__:WPA2 + :XX\:XX\:XX\:XX\:XX\:XX:Madchenband:Infra:11:260 Mbit/s:40:▂▄__:WPA2 + :XX\:XX\:XX\:XX\:XX\:XX:LenbrO:Infra:36:270 Mbit/s:37:▂▄__:WPA2 + :XX\:XX\:XX\:XX\:XX\:XX::Infra:11:260 Mbit/s:34:▂▄__:WPA2 + :XX\:XX\:XX\:XX\:XX\:XX:EEG-04666:Infra:1:405 Mbit/s:30:▂___:WPA2 + :XX\:XX\:XX\:XX\:XX\:XX:Salt_2GHz_8A9170:Infra:11:260 Mbit/s:29:▂___:WPA2 + :XX\:XX\:XX\:XX\:XX\:XX:FRITZ!Box 5490 PB:Infra:60:405 Mbit/s:27:▂___:WPA2 + :XX\:XX\:XX\:XX\:XX\:XX:Madchenband2.0:Infra:100:540 Mbit/s:25:▂___:WPA2 + :XX\:XX\:XX\:XX\:XX\:XX::Infra:11:260 Mbit/s:24:▂___:WPA2 + :XX\:XX\:XX\:XX\:XX\:XX:FibreBox_X6-01EF47:Infra:44:540 Mbit/s:20:▂___:WPA2 +``` +## [[iw]] +### `iw dev` +Useful to list interfaces and see which hardware they correspond to. +Can use that to create a monitor interface with an easier to remember name. +``` +phy#1 + Unnamed/non-netdev interface + wdev 0x100000002 + addr 3c:21:9c:f2:e4:00 + type P2P-device + Interface wlp44s0 + ifindex 5 + wdev 0x100000001 + addr e6:bf:0c:3c:47:ba + ssid LenbrO + type managed + channel 100 (5500 MHz), width: 80 MHz, center1: 5530 MHz + txpower 22.00 dBm + multicast TXQ: + qsz-byt qsz-pkt flows drops marks overlmt hashcol tx-bytes tx-packets + 0 0 0 0 0 0 0 0 0 +phy#0 + Interface mon0 + ifindex 7 + wdev 0x2 + addr a8:42:a1:8b:f4:e3 + type monitor + channel 6 (2437 MHz), width: 20 MHz (no HT), center1: 2437 MHz + txpower 20.00 dBm + Interface wlp0s20f0u6 + ifindex 4 + wdev 0x1 + addr a8:42:a1:8b:f4:e3 + type monitor + channel 6 (2437 MHz), width: 20 MHz (no HT), center1: 2437 MHz + txpower 20.00 dBm + multicast TXQ: + qsz-byt qsz-pkt flows drops marks overlmt hashcol tx-bytes tx-packets + 0 0 0 0 0 0 0 0 0 + +``` +Here, `phy#1` is my laptops built-in WiFi card, and `phy#0` is a WiFi USB adapter. +### `iw [phy phy | phy#] info | grep -f monitor -B 10` +``` +➜ iw phy phy0 info | fgrep monitor -B 10 + * CMAC-256 (00-0f-ac:13) + * GMAC-128 (00-0f-ac:11) + * GMAC-256 (00-0f-ac:12) + Available Antennas: TX 0x3 RX 0x3 + Configured Antennas: TX 0x3 RX 0x3 + Supported interface modes: + * IBSS + * managed + * AP + * AP/VLAN + * monitor +-- + * register_beacons + * start_p2p_device + * set_mcast_rate + * connect + * disconnect + * set_qos_map + * set_multicast_to_unicast + * set_sar_specs + software interface modes (can always be added): + * AP/VLAN + * monitor +``` +Can do better +### `iw phy#0 info | grep monitor` +``` + * monitor + * monitor +``` +Concise but possible need more context to be sure? +### `iw phy phy0 info | sed -n '/software interface modes/,/monitor/p'` +More concise but with good context. Assuming only sw interfaces need to support monitor mode +``` + software interface modes (can always be added): + * AP/VLAN + * monitor +``` +### Getting a monitor interface +``` +iw phy#0 interface add mon0 type monitor +``` +Add a easy interface to wifi hw and make it a monitor. Can check again with 'iw dev' to make sure it is really in monitor mode. If there is an other interface it must be taken down or deleted e.g with +``` +iw dev del # or +ip link set down +``` +Then to enable `mon0` interface, +``` +ip link set mon0 up +``` +To effectively capture packets, we should set the interface to the correct frequency. For this we get the channel e.g. via the above mentioned `nmcli dev wifi`. We can see that, e.g. the BSSID I am connected to (marked with `*`) is on channel 100. We can also see that it there is also a BSSID belonging to the same SSID with the interface on channel 6. I.e., it is running one interface in 2.4 GHz (802.11b/g/n/ax/be) and one in 5 GHz (802.11a/h/n/ac/ax/be). We chose which which channel to tune our `mon0` interface to, then we can lookup what the center frequency is on [wikipedia(List of Wifi Channels)](https://en.wikipedia.org/wiki/List_of_WLAN_channels). E.g. for channel 6 (i.e. 2.4 GHz radio) we see that the center frequency is 2437. We set our interface to that frequency: +``` +iw dev mon0 set freq 2437 +``` +Now double check that the interface is in monitor mode and tunedto the correct frequency: +``` +iw dev mon0 info +``` +Should give an output like +``` +Interface mon0 + ifindex 7 + wdev 0x2 + addr a8:42:a1:8b:f4:e3 + type monitor + wiphy 0 + channel 6 (2437 MHz), width: 20 MHz (no HT), center1: 2437 MHz + txpower 20.00 dBm +``` +This concludes preparing the wifi card for packet capture in monitor mode. +### [remarks] +- `sudo` is probably required for these commands +- These network tools are what is available on fedora 40, on $(uname -r)= 6.8.8 Linux Kernel. It might be that other OSs still use older tools, which are being phased out. But other operating systems might still be using older versions of these commands. For a table on how they match up, see [this](https://www.tecmint.com/deprecated-linux-networking-commands-and-their-replacements/) recent article (July 2023), according to which the old commands are even deprecated in recent Debian and Ubuntu releases. +- If smth is not working run `rfkill list` to check device is blocked. If it is, `rfkill unblock 0`, where `0` is the same index used above and represents `phy0` /`phy#0`. +- To ensure that [[NetworkManager]] not managing you card, `nmcli device set wlp0s20f0u6 managed no` if the interface is called `wlp0s20f0u6`. Check with `nmcli dev`, the STATE should be "unmanaged". +- See resources on how to put interface/wifi hardware back into managed mode, if you need the card for personal use. \ No newline at end of file