Documentation/networking/mac80211-injection.txt

   1 How to use packet injection with mac80211
   2 =========================================
   3
   4 mac80211 now allows arbitrary packets to be injected down any Monitor Mode
   5 interface from userland.  The packet you inject needs to be composed in the
   6 following format:
   7
   8  [ radiotap header  ]
   9  [ ieee80211 header ]
  10  [ payload ]
  11
  12 The radiotap format is discussed in
  13 ./Documentation/networking/radiotap-headers.txt.
  14
  15 Despite many radiotap parameters being currently defined, most only make sense
  16 to appear on received packets.  The following information is parsed from the
  17 radiotap headers and used to control injection:
  18
  19  * IEEE80211_RADIOTAP_FLAGS
  20
  21    IEEE80211_RADIOTAP_F_FCS: FCS will be removed and recalculated
  22    IEEE80211_RADIOTAP_F_WEP: frame will be encrypted if key available
  23    IEEE80211_RADIOTAP_F_FRAG: frame will be fragmented if longer than the
  24                               current fragmentation threshold.
  25
  26  * IEEE80211_RADIOTAP_TX_FLAGS
  27
  28    IEEE80211_RADIOTAP_F_TX_NOACK: frame should be sent without waiting for
  29                                   an ACK even if it is a unicast frame
  30
  31  * IEEE80211_RADIOTAP_RATE
  32
  33    legacy rate for the transmission (only for devices without own rate control)
  34
  35  * IEEE80211_RADIOTAP_MCS
  36
  37    HT rate for the transmission (only for devices without own rate control).
  38    Also some flags are parsed
  39
  40    IEEE80211_RADIOTAP_MCS_SGI: use short guard interval
  41    IEEE80211_RADIOTAP_MCS_BW_40: send in HT40 mode
  42
  43  * IEEE80211_RADIOTAP_DATA_RETRIES
  44
  45    number of retries when either IEEE80211_RADIOTAP_RATE or
  46    IEEE80211_RADIOTAP_MCS was used
  47
  48  * IEEE80211_RADIOTAP_VHT
  49
  50    VHT mcs and number of streams used in the transmission (only for devices
  51    without own rate control). Also other fields are parsed
  52
  53    flags field
  54    IEEE80211_RADIOTAP_VHT_FLAG_SGI: use short guard interval
  55
  56    bandwidth field
  57    1: send using 40MHz channel width
  58    4: send using 80MHz channel width
  59    11: send using 160MHz channel width
  60
  61 The injection code can also skip all other currently defined radiotap fields
  62 facilitating replay of captured radiotap headers directly.
  63
  64 Here is an example valid radiotap header defining some parameters
  65
  66         0x00, 0x00, // <-- radiotap version
  67         0x0b, 0x00, // <- radiotap header length
  68         0x04, 0x0c, 0x00, 0x00, // <-- bitmap
  69         0x6c, // <-- rate
  70         0x0c, //<-- tx power
  71         0x01 //<-- antenna
  72
  73 The ieee80211 header follows immediately afterwards, looking for example like
  74 this:
  75
  76         0x08, 0x01, 0x00, 0x00,
  77         0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
  78         0x13, 0x22, 0x33, 0x44, 0x55, 0x66,
  79         0x13, 0x22, 0x33, 0x44, 0x55, 0x66,
  80         0x10, 0x86
  81
  82 Then lastly there is the payload.
  83
  84 After composing the packet contents, it is sent by send()-ing it to a logical
  85 mac80211 interface that is in Monitor mode.  Libpcap can also be used,
  86 (which is easier than doing the work to bind the socket to the right
  87 interface), along the following lines:
  88
  89         ppcap = pcap_open_live(szInterfaceName, 800, 1, 20, szErrbuf);
  90 ...
  91         r = pcap_inject(ppcap, u8aSendBuffer, nLength);
  92
  93 You can also find a link to a complete inject application here:
  94
  95 http://wireless.kernel.org/en/users/Documentation/packetspammer
  96
  97 Andy Green <andy@warmcat.com>