Hi All, I am new to kernel development. I am writing a kernel module that captures packet at the netfilter pre - routing hook. I only want to capture the BEACON FRAME. I have few queries: 1>When the beacon frame comes to receiving machine do the sk_buff gets allocated? 2> How can i identify the beacon frame at the pre routing hook? 3> Beacon frame consist of a string for authentication of client with the server, can i use sk_buff pointers to get access to that string, if sk_buff is allocated? Regards Gunjan
From: kernelnewbies-bounces@kernelnewbies.org [mailto:kernelnewbies-bounces@kernelnewbies.org] On Behalf Of Gunjan Mehta Sent: Friday, August 28, 2015 9:21 AM To: kernelnewbies; netfilter-devel@vger.kernel.org Subject: Identify Beacon Frame Hi All, I am new to kernel development. I am writing a kernel module that captures packet at the netfilter pre - routing hook. I only want to capture the BEACON FRAME. I have few queries: 1>When the beacon frame comes to receiving machine do the sk_buff gets allocated? 2> How can i identify the beacon frame at the pre routing hook? 3> Beacon frame consist of a string for authentication of client with the server, can i use sk_buff pointers to get access to that string, if sk_buff is allocated? Regards Gunjan These beacon frames do not appear to be IP packets. If that is true, I don’t think you are going to see them in any netfilter hooks. Jeff Haran
Then how do i capture the beacon frames? On Fri, Aug 28, 2015 at 10:40 PM, Jeff Haran <Jeff.Haran@citrix.com> wrote:
*From:* kernelnewbies-bounces@kernelnewbies.org [mailto: kernelnewbies-bounces@kernelnewbies.org] *On Behalf Of *Gunjan Mehta *Sent:* Friday, August 28, 2015 9:21 AM *To:* kernelnewbies; netfilter-devel@vger.kernel.org *Subject:* Identify Beacon Frame
Hi All,
I am new to kernel development. I am writing a kernel module that captures packet at the netfilter pre - routing hook.
I only want to capture the BEACON FRAME.
I have few queries:
1>When the beacon frame comes to receiving machine do the sk_buff gets allocated?
2> How can i identify the beacon frame at the pre routing hook?
3> Beacon frame consist of a string for authentication of client with the server, can i use sk_buff pointers to get access to that string, if sk_buff is allocated?
Regards
Gunjan
These beacon frames do not appear to be IP packets. If that is true, I don’t think you are going to see them in any netfilter hooks.
Jeff Haran
Hi Gunjan, Are you talking about WLAN beacon frames? If so, you can you cfg80211 handlers to register management frames and once frame is received parse frame type/subtype to check if its beacon. I dont think beacon frames are delievered to netdev. Thanks, Avinash On Fri, Aug 28, 2015 at 10:51 AM, Gunjan Mehta <gunjanmehta08@gmail.com> wrote:
Then how do i capture the beacon frames?
On Fri, Aug 28, 2015 at 10:40 PM, Jeff Haran <Jeff.Haran@citrix.com> wrote:
From: kernelnewbies-bounces@kernelnewbies.org [mailto:kernelnewbies-bounces@kernelnewbies.org] On Behalf Of Gunjan Mehta Sent: Friday, August 28, 2015 9:21 AM To: kernelnewbies; netfilter-devel@vger.kernel.org Subject: Identify Beacon Frame
Hi All,
I am new to kernel development. I am writing a kernel module that captures packet at the netfilter pre - routing hook.
I only want to capture the BEACON FRAME.
I have few queries:
1>When the beacon frame comes to receiving machine do the sk_buff gets allocated?
2> How can i identify the beacon frame at the pre routing hook?
3> Beacon frame consist of a string for authentication of client with the server, can i use sk_buff pointers to get access to that string, if sk_buff is allocated?
Regards
Gunjan
These beacon frames do not appear to be IP packets. If that is true, I don’t think you are going to see them in any netfilter hooks.
Jeff Haran
_______________________________________________ Kernelnewbies mailing list Kernelnewbies@kernelnewbies.org http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
Avinash, Ya m talking about the WLAN. can you just throw some more light on cfg802.11 handlers. On Fri, Aug 28, 2015 at 11:24 PM, Avinash Patil <avinashapatil@gmail.com> wrote:
Hi Gunjan,
Are you talking about WLAN beacon frames? If so, you can you cfg80211 handlers to register management frames and once frame is received parse frame type/subtype to check if its beacon. I dont think beacon frames are delievered to netdev.
Thanks, Avinash
On Fri, Aug 28, 2015 at 10:51 AM, Gunjan Mehta <gunjanmehta08@gmail.com> wrote:
Then how do i capture the beacon frames?
On Fri, Aug 28, 2015 at 10:40 PM, Jeff Haran <Jeff.Haran@citrix.com> wrote:
From: kernelnewbies-bounces@kernelnewbies.org [mailto:kernelnewbies-bounces@kernelnewbies.org] On Behalf Of Gunjan
Mehta
Sent: Friday, August 28, 2015 9:21 AM To: kernelnewbies; netfilter-devel@vger.kernel.org Subject: Identify Beacon Frame
Hi All,
I am new to kernel development. I am writing a kernel module that captures packet at the netfilter pre - routing hook.
I only want to capture the BEACON FRAME.
I have few queries:
1>When the beacon frame comes to receiving machine do the sk_buff gets allocated?
2> How can i identify the beacon frame at the pre routing hook?
3> Beacon frame consist of a string for authentication of client with the server, can i use sk_buff pointers to get access to that string, if sk_buff is allocated?
Regards
Gunjan
These beacon frames do not appear to be IP packets. If that is true, I don’t think you are going to see them in any netfilter hooks.
Jeff Haran
_______________________________________________ Kernelnewbies mailing list Kernelnewbies@kernelnewbies.org http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
Well..from userspace application you need to register which subtype of frames you want to receive. This is done with netlink sockets. You can check hostapd/wpa_supplicant sources to see how this is done. http://w1.fi/wpa_supplicant/ I assume you are using newer kernel e.g. 3.0 onwards. Old kernels did not support cfg80211; also your WLAN device driver needs to support mgmt register and mgmt rx. https://www.kernel.org/doc/htmldocs/80211/API-struct-cfg80211-ops.html Thanks, Avinash On Fri, Aug 28, 2015 at 10:57 AM, Gunjan Mehta <gunjanmehta08@gmail.com> wrote:
Avinash,
Ya m talking about the WLAN. can you just throw some more light on cfg802.11 handlers.
On Fri, Aug 28, 2015 at 11:24 PM, Avinash Patil <avinashapatil@gmail.com> wrote:
Hi Gunjan,
Are you talking about WLAN beacon frames? If so, you can you cfg80211 handlers to register management frames and once frame is received parse frame type/subtype to check if its beacon. I dont think beacon frames are delievered to netdev.
Thanks, Avinash
On Fri, Aug 28, 2015 at 10:51 AM, Gunjan Mehta <gunjanmehta08@gmail.com> wrote:
Then how do i capture the beacon frames?
On Fri, Aug 28, 2015 at 10:40 PM, Jeff Haran <Jeff.Haran@citrix.com> wrote:
From: kernelnewbies-bounces@kernelnewbies.org [mailto:kernelnewbies-bounces@kernelnewbies.org] On Behalf Of Gunjan Mehta Sent: Friday, August 28, 2015 9:21 AM To: kernelnewbies; netfilter-devel@vger.kernel.org Subject: Identify Beacon Frame
Hi All,
I am new to kernel development. I am writing a kernel module that captures packet at the netfilter pre - routing hook.
I only want to capture the BEACON FRAME.
I have few queries:
1>When the beacon frame comes to receiving machine do the sk_buff gets allocated?
2> How can i identify the beacon frame at the pre routing hook?
3> Beacon frame consist of a string for authentication of client with the server, can i use sk_buff pointers to get access to that string, if sk_buff is allocated?
Regards
Gunjan
These beacon frames do not appear to be IP packets. If that is true, I don’t think you are going to see them in any netfilter hooks.
Jeff Haran
_______________________________________________ Kernelnewbies mailing list Kernelnewbies@kernelnewbies.org http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
Hi All, On Friday, August 28, 2015 11:44 PM, Avinash Patil <avinashapatil@gmail.com> wrote: Well..from userspace application you need to register which subtype of frames you want to receive. This is done with netlink sockets. You can check hostapd/wpa_supplicant sources to see how this is done. http://w1.fi/wpa_supplicant/ I assume you are using newer kernel e.g. 3.0 onwards. Old kernels did not support cfg80211; also your WLAN device driver needs to support mgmt register and mgmt rx. https://www.kernel.org/doc/htmldocs/80211/API-struct-cfg80211-ops.html Thanks, Avinash On Fri, Aug 28, 2015 at 10:57 AM, Gunjan Mehta <gunjanmehta08@gmail.com> wrote:
Avinash,
Ya m talking about the WLAN. can you just throw some more light on cfg802.11 handlers.
On Fri, Aug 28, 2015 at 11:24 PM, Avinash Patil <avinashapatil@gmail.com> wrote:
Hi Gunjan,
Are you talking about WLAN beacon frames? If so, you can you cfg80211 handlers to register management frames and once frame is received parse frame type/subtype to check if its beacon. I dont think beacon frames are delievered to netdev.
Thanks, Avinash
On Fri, Aug 28, 2015 at 10:51 AM, Gunjan Mehta <gunjanmehta08@gmail.com> wrote:
Then how do i capture the beacon frames?
On Fri, Aug 28, 2015 at 10:40 PM, Jeff Haran <Jeff.Haran@citrix.com> wrote:
From: kernelnewbies-bounces@kernelnewbies.org [mailto:kernelnewbies-bounces@kernelnewbies.org] On Behalf Of Gunjan Mehta Sent: Friday, August 28, 2015 9:21 AM To: kernelnewbies; netfilter-devel@vger.kernel.org Subject: Identify Beacon Frame
Hi All,
I am new to kernel development. I am writing a kernel module that captures packet at the netfilter pre - routing hook.
I only want to capture the BEACON FRAME.
I have few queries:
1>When the beacon frame comes to receiving machine do the sk_buff gets allocated?
2> How can i identify the beacon frame at the pre routing hook?
3> Beacon frame consist of a string for authentication of client with the server, can i use sk_buff pointers to get access to that string, if sk_buff is allocated?
Regards
Gunjan
These beacon frames do not appear to be IP packets. If that is true, I don’t think you are going to see them in any netfilter hooks.
Jeff Haran
If the interface support monitor mode. Then you can capture any packet. iw dev wlan0 interface add mon0 type monitor flags none ifconfig mon0 up Now you can capture all the packets on mon0 interface. -Anand Moon
_______________________________________________ Kernelnewbies mailing list Kernelnewbies@kernelnewbies.org http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
_______________________________________________ Kernelnewbies mailing list Kernelnewbies@kernelnewbies.org http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
From: Gunjan Mehta [mailto:gunjanmehta08@gmail.com] Sent: Friday, August 28, 2015 10:51 AM To: Jeff Haran Cc: kernelnewbies Subject: Re: Identify Beacon Frame Then how do i capture the beacon frames? On Fri, Aug 28, 2015 at 10:40 PM, Jeff Haran <Jeff.Haran@citrix.com<mailto:Jeff.Haran@citrix.com>> wrote: I don’t know. Pcap maybe. Jeff Haran From: kernelnewbies-bounces@kernelnewbies.org<mailto:kernelnewbies-bounces@kernelnewbies.org> [mailto:kernelnewbies-bounces@kernelnewbies.org<mailto:kernelnewbies-bounces@kernelnewbies.org>] On Behalf Of Gunjan Mehta Sent: Friday, August 28, 2015 9:21 AM To: kernelnewbies; netfilter-devel@vger.kernel.org<mailto:netfilter-devel@vger.kernel.org> Subject: Identify Beacon Frame Hi All, I am new to kernel development. I am writing a kernel module that captures packet at the netfilter pre - routing hook. I only want to capture the BEACON FRAME. I have few queries: 1>When the beacon frame comes to receiving machine do the sk_buff gets allocated? 2> How can i identify the beacon frame at the pre routing hook? 3> Beacon frame consist of a string for authentication of client with the server, can i use sk_buff pointers to get access to that string, if sk_buff is allocated? Regards Gunjan These beacon frames do not appear to be IP packets. If that is true, I don’t think you are going to see them in any netfilter hooks. Jeff Haran
participants (4)
-
Anand Moon -
Avinash Patil -
Gunjan Mehta -
Jeff Haran