Re: Fwd: Monitor mode (w. TP-Link WN722N & Fedora)

[Fulko Hew]

On Tue, Sep 29, 2020 at 3:07 PM Samuel Sieb <samuel(a)sieb.net&gt; wrote:

>  On 9/29/20 10:33 AM, Fulko Hew wrote:
>  > No, no other thread. In the original email I used iw command to turn
>  > manage off.
>  >
>  > wlp2s0f0u4  wifi      unmanaged  --
>  >
>  > wlp2s0f0u4  unassociated  ESSID:"" 
> Nickname:"<WIFI@REALTEK>"
>  >            Mode:Managed  Frequency=2.412 GHz  Access Point:
>  Not-Associated
>  >
>  > So now nmcli says it's unmanaged but iwconfig says it IS managed.
>
>  Ok, that is a little confusing.  The nmcli "managed" means that
>  NetworkManger is handling the device.  The iwconfig "managed" is
>  referring to the mode that the wifi device is in.
>
>  > So I also tried both of the following to enable monitor:
>  >
>  > [root@localhost fhew]# iw wlp2s0f0u4 set monitor none
>  > command failed: No such device (-19)
>
>  That can't be the actual command you ran, because it's not valid.
>  You're missing a "dev".
>  
I hear what you're saying, and yes, the man page says you should have a
'dev' in there,
but that doesn't make any difference"

[root@localhost fhew]# iw dev wlp2s0f0u4 set monitor none
command failed: No such device (-19)


>  > [root@localhost fhew]# iwconfig wlp2s0f0u4 mode monitor
>  > Error for wireless request "Set Mode" (8B06) :
>  >      SET failed on device wlp2s0f0u4 ; Invalid argument.
>  >
>  > and neither worked.  So I'm back to thinking it's a driver issue.
>
>  Yes, that seems very likely to be the reason for both those commands
>  failing.
>  
Where to look next ?
I started this journey with a variety of web pages such as this one:
https://www.hackster.io/thatiotguy/enable-monitor-mode-in-tp-link-tl-wn72...

I'm not wedded to this USB adapter, I'd like to know which one would
actually work
in monitor mode, out of the box, with Fedora supplied drivers.

>  P.S.  Looking at the newer Wireshark, I still didn't see a
> 'monitor'
>  > button.  Perhaps it's because the wi-fi driver isn't supporting it?
>
>  When you open the capture options dialog, you might need to scroll to
>  the right to see the monitor checkbox. 

Nope, I tried sending a screen shot, but the mailing list is holding my
message for moderation.
There is a column in the table entitled Monitor Mode, but it's filled in
with dashes.

Fwd: Monitor mode (w. TP-Link WN722N & Fedora)

[Samuel Sieb]

On 9/29/20 1:00 PM, Fulko Hew wrote:
>  On Tue, Sep 29, 2020 at 3:07 PM Samuel Sieb <samuel(a)sieb.net 
>  <mailto:[e-mail]>> wrote:
>      On 9/29/20 10:33 AM, Fulko Hew wrote:
>      > [root@localhost fhew]# iw wlp2s0f0u4 set monitor none
>      > command failed: No such device (-19)
>  
>      That can't be the actual command you ran, because it's not valid.
>      You're missing a "dev".
>  
>  I hear what you're saying, and yes, the man page says you should have a 
>  'dev' in there,
>  but that doesn't make any difference" 
That's interesting.  If I run it without that "dev", it just gives me an 
error and the help text.

>  Where to look next ?
>  I started this journey with a variety of web pages such as this one:
>  https://www.hackster.io/thatiotguy/enable-monitor-mode-in-tp-link-tl-wn72...
It looks to me like they used an alternate driver to make that work.

>  I'm not wedded to this USB adapter, I'd like to know which
> one would 
>  actually work
>  in monitor mode, out of the box, with Fedora supplied drivers. 
It works with the Intel Centrino adapter in my laptop and also with the 
two USB ones I tried.  One was a really old Airlink 101 and the other 
was a tiny, cheap one that I got online with some Realtek chip that uses 
the rtl8192cu driver.  The Airlink I couldn't switch to monitor mode 
inside wireshark, I had to set it from the command line before for some 
reason, but the others could be turned on by wireshark.

Try using your built-in wifi adapter.

>      > P.S.  Looking at the newer Wireshark, I still didn't see
> a 'monitor'
>      > button.  Perhaps it's because the wi-fi driver isn't supporting it?
>  
>      When you open the capture options dialog, you might need to scroll to
>      the right to see the monitor checkbox.
>  
>  Nope, I tried sending a screen shot, but the mailing list is holding my 
>  message for moderation. 
If you grabbed the whole screen, it was probably too big.  I've attached 
a shot of just the area.

>  There is a column in the table entitled Monitor Mode, but it's
> filled in 
>  with dashes. 
Just checking, is your user in the wireshark group?  Do you even see 
your network adapters in the list?

Fwd: Monitor mode (w. TP-Link WN722N & Fedora)

[Fulko Hew]

On Tue, Sep 29, 2020 at 4:49 PM Samuel Sieb <samuel(a)sieb.net&gt; wrote:


>  > Where to look next ?
>  > I started this journey with a variety of web pages such as this one:
>  >
>  https://www.hackster.io/thatiotguy/enable-monitor-mode-in-tp-link-tl-wn72...
>
>  It looks to me like they used an alternate driver to make that work.
>  
It seems so, they were using a 'current' driver.
Using modinfo, I see that both my F26 and F32 are using the same driver,
v4.1.4_6773.20130222.
Whereas the Monitor support was added to the driver circa Sep 2015.
So Fedora has been shipping a (very out of date?) driver.

>  I'm not wedded to this USB adapter, I'd like to know which
> one would
>  > actually work
>  > in monitor mode, out of the box, with Fedora supplied drivers.
>
>  It works with the Intel Centrino adapter in my laptop and also with the
>  two USB ones I tried.  One was a really old Airlink 101 and the other
>  was a tiny, cheap one that I got online with some Realtek chip that uses
>  the rtl8192cu driver.  The Airlink I couldn't switch to monitor mode
>  inside wireshark, I had to set it from the command line before for some
>  reason, but the others could be turned on by wireshark.
>
>  Try using your built-in wifi adapter.
>  
I did (as mentioned), and it didn't get me anywhere, (Intel 3165)
I'll re-investigate though.

>      > P.S.  Looking at the newer Wireshark, I still didn't see
> a 'monitor'
>  >     > button.  Perhaps it's because the wi-fi driver isn't supporting
> it?
>  >
>  >     When you open the capture options dialog, you might need to scroll to
>  >     the right to see the monitor checkbox.
>  >
>  > Nope, I tried sending a screen shot, but the mailing list is holding my
>  > message for moderation.
>
>  If you grabbed the whole screen, it was probably too big.  I've attached
>  a shot of just the area.
>  
Yeah, that's what I see, except, I get dashes instead of the checkboxes.

>  There is a column in the table entitled Monitor Mode, but it's
> filled in
>  > with dashes.
>
>  Just checking, is your user in the wireshark group?  Do you even see
>  your network adapters in the list?
>  
Yes

Fwd: Monitor mode (w. TP-Link WN722N & Fedora)

[Samuel Sieb]

On 9/29/20 2:47 PM, Fulko Hew wrote:
>  On Tue, Sep 29, 2020 at 4:49 PM Samuel Sieb <samuel(a)sieb.net 
>  <mailto:[e-mail]>> wrote:
>  
>       > Where to look next ?
>       > I started this journey with a variety of web pages such as this one:
>       >
>     
> https://www.hackster.io/thatiotguy/enable-monitor-mode-in-tp-link-tl-wn72...
>  
>      It looks to me like they used an alternate driver to make that work.
>  
>  It seems so, they were using a 'current' driver. 
"current" from a third-party repo.

>  Using modinfo, I see that both my F26 and F32 are using the same
> driver, 
>  v4.1.4_6773.20130222.
>  Whereas the Monitor support was added to the driver circa Sep 2015.
>  So Fedora has been shipping a (very out of date?) driver. 
Fedora only distributes the drivers provided by the upstream kernel, not 
third-party ones.

>      Try using your built-in wifi adapter.
>  
>  I did (as mentioned), and it didn't get me anywhere, (Intel 3165)
>  I'll re-investigate though. 
That was on the old Fedora and wireshark.  Also, you didn't tell 
NetworkManager to leave it alone.

>      If you grabbed the whole screen, it was probably too big. 
> I've
>      attached
>      a shot of just the area.
>  
>  Yeah, that's what I see, except, I get dashes instead of the checkboxes. 
Then maybe your devices don't support it, although it looked like you 
were able to switch the onboard one into monitor mode.  This F32 system 
you're using is different from that one though.  Which device does it have?