How to configure a ZD1211B wireless stick to monitor mode on Wireshark using Fedora 7

[Lopes_sma]

I there guys!
Need some help doing an audit to my wireless network.
Is it possible to use a ZD1211B chip based wireless stick in monitor or promiscuous mode with Wireshark 0.99.5?
If not with Wireshark is there any protocol analyzer that supports this stick in monitor mode?

I've searched the web and the most recent post say this stick supports monitor mode:
http://linuxwireless.org/en/users/Drivers/zd1211rw
http://www.reactivated.net/weblog/ar...5/zd1211-news/

I use Fedora 7 and I installed this stick just by updating F7 and reboting.
I run Linux 2.6.21-1.3228.fc7, with libpcap version 0.9.5.

Using Wireshark I configured my interface wmaster0 to capture in promiscuous mode but i get nothing else than probe requests and no filter is configured.

Any ideas

Please explain everything so i can follow it step by step because i'm a newbie and a total noob with Linux...How to configure a ZD1211B wireless stick to monitor mode on Wireshark using Fedora 7

[stevea]

Wireshark *should* work with this chip.

You *should* be able to set the chip in Monitor mode using the "iwconfig" command.

see "man iwconfig", and examine the "mode" option.

I suggest that you practice w/ iwconfig by getting it to associate with an unprotected AP. There are some subtle tricks to iwconfig.

[Lopes_sma]

Guys I really need some Linux newbie help!
How does one get to the root in the Fedora terminal?

I found a great help in Wireshark to activate monitor mode but i can't run any commands.
http://wiki.wireshark.org/CaptureSet...b7398935b1a4d4

Here's what I have in my terminal when i type the first recomended command:

[Bruno@localhost ~]$ iwconfig wmaster0 monitor mode
bash: iwconfig: command not found

(this is because i'm not on the root righ? so how do i get there? what should i type?)


Please explain everything so i can follow it step by step because i'm a newbie and a total noob with Linux...

[Lopes_sma]

Ok I googled and got to the root by typing su and entering my root pass.

Ran ifconfig and got:
wlan0 Link encap:Ethernet HWaddr 00:0E:XX:XX:XX:XX
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)

wmaster0 Link encap:UNSPEC HWaddr 00-0E-XX-XX-XX-XX-C8-58-00-00-00-00-00-00-00-00
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:31005 errors:0 dropped:0 overruns:0 frame:0
TX packets:20383 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:39237968 (37.4 MiB) TX bytes:2047462 (1.9 MiB)


THEN I RAN IWCONFIG BUT I GOT THIS ERROR:

[root@localhost Bruno]# /sbin/iwconfig wlan0 mode Monitor
Error for wireless request "Set Mode" (8B06) :
SET failed on device wlan0 ; Device or resource busy.

(it say it's busy but i'm connected to my wired connection!!!!!)

[root@localhost Bruno]# /sbin/iwconfig wmaster0 mode Monitor
Error for wireless request "Set Mode" (8B06) :
SET failed on device wmaster0 ; Operation not supported.

(wlan0 and wmaster0 have the same mac adress, so why it's not supported?)


FYI when i run lsmod i get among other drivers these


rc80211_simple 8257 1
zd1211rw_mac80211 46661 0
mac80211 145609 2 rc80211_simple,zd1211rw_mac80211
cfg80211 12105 1 mac80211


My Linux version is
2.6.21-1.3228.fc7 #1 SMP Tue Jun 12 15:37:31 EDT 2007 i686 i686 i386 GNU/Linux

From what I read the zd1211rw-mac80211 driver supports monitor mode on zd1211b chip based usb sticks
http://linuxwireless.org/en/users/Drivers/zd1211rw

Can you help me swich my usb stick to monitor mode?
What am I missing?

[Lopes_sma]

Ok here's what i learned until now.

FYI (before changing to monitor mode these were my devices settings)

[root@localhost Bruno]# /sbin/iwconfig wlan0
wlan0 IEEE 802.11g ESSID:""
Mode:Managed Frequency:2.412 GHz Access Point: Not-Associated
Retry min limit:7 RTS thr:off Fragment thr=2346 B
Encryption key:off
Link Quality:0 Signal level:0 Noise level:0
Rx invalid nwid:0 Rx invalid crypt:0 Rx invalid frag:0
Tx excessive retries:0 Invalid misc:0 Missed beacon:0


To change the mode I have to bring down the zd1211rw-mac80211 driver with:

[root@localhost Bruno]# /sbin/ifconfig wlan0 down

then change the to monitor mode with

[root@localhost Bruno]# /sbin/iwconfig wlan0 mode monitor

but when i try to type the commands to bring it up before i hit enter it shows this:

[root@localhost Bruno]# /sbin/iwconfig wlan0 mode monitor
Message from syslogd@ at Tue Jul 3 12:53:36 2007 ...
localhost kernel: Oops: 0000 [#1]
Message from syslogd@ at Tue Jul 3 12:53:36 2007 ...
localhost kernel: SMP
Message from syslogd@ at Tue Jul 3 12:53:36 2007 ...
localhost kernel: CPU: 0
Message from syslogd@ at Tue Jul 3 12:53:36 2007 ...
localhost kernel: EIP: 0060:[<f8a94fa7>] Not tainted VLI
Message from syslogd@ at Tue Jul 3 12:53:36 2007 ...
localhost kernel: EFLAGS: 00210246 (2.6.21-1.3228.fc7 #1)
Message from syslogd@ at Tue Jul 3 12:53:36 2007 ...
localhost kernel: EIP is at zd_mac_config_interface+0x9/0x31 [zd1211rw_mac80211]
Message from syslogd@ at Tue Jul 3 12:53:36 2007 ...
localhost kernel: eax: 00000000 ebx: c2facf20 ecx: c2fe4e14 edx: 00000000
Message from syslogd@ at Tue Jul 3 12:53:36 2007 ...
localhost kernel: esi: c2fab000 edi: c2fe4e34 ebp: c2fac1c0 esp: c2fe4e08
Message from syslogd@ at Tue Jul 3 12:53:36 2007 ...
localhost kernel: ds: 007b es: 007b fs: 00d8 gs: 0033 ss: 0068
Message from syslogd@ at Tue Jul 3 12:53:36 2007 ...
localhost kernel: Process NetworkManager (pid: 7796, ti=c2fe4000 task=e60ca270 task.ti=c2fe4000)
Message from syslogd@ at Tue Jul 3 12:53:36 2007 ...
localhost kernel: Stack: f8a97e60 f9549966 00000000 00000004 00000000 00000000 00000000 00000000
Message from syslogd@ at Tue Jul 3 12:53:36 2007 ...
localhost kernel: 00000000 00000000 00000000 c2fac1c0 c2fac990 da583000 00000000 f95572a8
Message from syslogd@ at Tue Jul 3 12:53:36 2007 ...
localhost kernel: c2fe4f30 0000013c 00000000 c2fab000 c2fe4f30 fffffff4 da583000 c061dac0
Message from syslogd@ at Tue Jul 3 12:53:36 2007 ...
localhost kernel: Call Trace:
Message from syslogd@ at Tue Jul 3 12:53:36 2007 ...
localhost kernel: [<f9549966>] __ieee80211_if_config+0xf9/0x105 [mac80211]
Message from syslogd@ at Tue Jul 3 12:53:36 2007 ...
localhost kernel: [<f95572a8>] ieee80211_sta_start_scan+0x15c/0x193 [mac80211]
Message from syslogd@ at Tue Jul 3 12:53:36 2007 ...
localhost kernel: [<c05fcbac>] ioctl_standard_call+0x1ff/0x2ce
Message from syslogd@ at Tue Jul 3 12:53:36 2007 ...
localhost kernel: [<c05fcd24>] wext_handle_ioctl+0xa9/0x370
Message from syslogd@ at Tue Jul 3 12:53:36 2007 ...
localhost kernel: [<f9552b37>] ieee80211_ioctl_siwscan+0x0/0x80 [mac80211]
Message from syslogd@ at Tue Jul 3 12:53:36 2007 ...
localhost kernel: [<f9552b37>] ieee80211_ioctl_siwscan+0x0/0x80 [mac80211]
Message from syslogd@ at Tue Jul 3 12:53:36 2007 ...
localhost kernel: [<c05989a8>] sock_ioctl+0x0/0x1be
Message from syslogd@ at Tue Jul 3 12:53:36 2007 ...
localhost kernel: [<c05a348d>] dev_ioctl+0x402/0x421
Message from syslogd@ at Tue Jul 3 12:53:36 2007 ...
localhost kernel: [<c0598ef7>] sock_attach_fd+0x70/0xcf
Message from syslogd@ at Tue Jul 3 12:53:36 2007 ...
localhost kernel: [<c04bf6e4>] selinux_file_alloc_security+0x1f/0x40
Message from syslogd@ at Tue Jul 3 12:53:36 2007 ...
localhost kernel: [<c05989a8>] sock_ioctl+0x0/0x1be
Message from syslogd@ at Tue Jul 3 12:53:36 2007 ...
localhost kernel: [<c047f713>] do_ioctl+0x1f/0x62
Message from syslogd@ at Tue Jul 3 12:53:36 2007 ...
localhost kernel: [<c047f99a>] vfs_ioctl+0x244/0x256
Message from syslogd@ at Tue Jul 3 12:53:36 2007 ...
localhost kernel: [<c047f9f8>] sys_ioctl+0x4c/0x64
Message from syslogd@ at Tue Jul 3 12:53:36 2007 ...
localhost kernel: [<c0404f70>] syscall_call+0x7/0xb
Message from syslogd@ at Tue Jul 3 12:53:36 2007 ...
localhost kernel: =======================
Message from syslogd@ at Tue Jul 3 12:53:36 2007 ...
localhost kernel: Code: 82 04 27 00 00 31 c0 5b c3 8b 40 5c c7 80 fc 26 00 00 01 00 00 00 c3 0f b6 12 8b 40 5c e9 48 f4 ff ff 53 8b 51 04 8b 58 5c 31 c0 <8a> 0a f6 c1 01 75 17 8a 42 02 0a 42 01 09 c8 0a 42 03 0a 42 04
Message from syslogd@ at Tue Jul 3 12:53:36 2007 ...
localhost kernel: EIP: [<f8a94fa7>] zd_mac_config_interface+0x9/0x31 [zd1211rw_m[root@localhost Bruno]# /sbin/ifconfig wlan0 up

/sbin/ifconfig wlan0 up was the command i was trying to bring it up.

Right after that my terminal stoped responding just has firefox and all other applications.
I tried to shut down and hit restart but that froze the hole system!!!
So I had to manually restart.

I tried it again, same thing happened!

What should i do?