[Madwifi-users] Packet Injection experiences

[David <sha...@gm...>]

Many people are asking about packet injection with the aircrack suite
lately and I though I would share my experience with this.

I have gentoo 2.6.12 with the proxim card, and tried to patch various
madwifi versions with all the different madwifi patches included with
aircrack and never got any of it to work.  The packets would "come out"
but they were always malformed, and to verify this I used ethereal on
the ath0 interface.  Try using ethereal sometime, with either the
unpatched or patched drivers with aireplay and you'll see what I mean.

Then I read the madwifi docs (and reading the docs is an accomplishment
in itself for me ;-) and found you can set a "raw" interface that
bypasses the internal state monitoring with these commands:

sysctl -w dev.ath0.rawdev=1      # create ath0raw
ifconfig ath0raw up              # start receiving packets on ath0raw

So when using aireplay do
./aireplay -2 -b whatever -n 100 -p 0841 \
    -h whatever -c FF:FF:FF:FF:FF:FF ath0raw

so do what you normally do but instead of ath0 try ath0raw.

In my experience this ath0raw works, and ethereal shows the packets
coming out as they should.  I never did get the patched drivers to work
on either the Auditor CD or when I manually patched them myself.

Hope this helps,
David