PDA

View Full Version : Cisco Systems 350 and Monitor mode



rubic_cube
03-10-2005, 04:38 PM
I'm setting up a network with a client that has a Cisco Systems 350 PCI wireless LAN adapter and is configured using an Aironet utility in Microsoft Windows.
Using Knoppix I was able to join the wireless network with the default router set up and could ping the router, so everything was working fine.

I then tried to set it to monitor mode using iwconfig eth0/wifi0 mode monitor, but it never changed the mode, I could change it to ad-hoc but not monitor mode.
I assume that this card does support monitor mode and doesn't need any patch drivers, if so then what can be the problem?

When I typed iwconfig eth0 mode monitor and pressed enter, the cursor went to a new line with nothing on it, not even the prompt. I tried opening Airsnort, Ethereal etc but they kept crashing. AirSnort gave me a "segmentation error".

I ran Kismet and got the error message "FATAL: pcap reported netlink type 1[EN10MB] on eth0. This problem means you are not in RFMON mode or your drivers are reporting a bad value. Make sure you have the correct drivers and that entering monitor mode succeeded."

Looking in Microsoft Windows device manager I found the following:
Driver - airo.C 0.6
Device - 350 series
Firmware Version - 4.25.30


1. Do I have the right driver or do I need to download some? if so which one's and where from?
2. How else can I set it to monitor mode other than iwconfig wifi0 mode monitor?

I ran a google search and someone said to solve it you need to do this:
#!/bin/sh
cardctl scheme kismet
ifconfig eth0 down
kismet-monitor -i eth0
ifconfig wifi0 up
echo "Mode: r"> /proc/driver/aironet/eth0/config
echo "Mode: y"> /proc/driver/aironet/eth0/config
kismet -1 wifi0

But I'm not sure if I have to edit a file or type it at the shell prompt, I typed it at the shell prompt and it never got past the first line "cardctl scheme kismet".

I looked in /proc/driver/aironet/eth0 but didn't see much except things such as status and the current config with the SSID etc.

Thanks for any help

rubic_cube
03-10-2005, 06:02 PM
I've just bought Wi-Foo The Secrets of Wireless Hacking, and had it on me when I was doing the testing but I've only just read it when I came home.
It says I just need to edit the /proc/driver/aironet/eth1/config from:

Mode: ESS

to

Mode: yna (any) bss rfmon

I will try that out when I get the chance, it also says that you can't lock this card to a single or set of channels in monitor mode becuase they will continue to hop though the band on a firmware level. There should be no problem with the drivers also.

If the channel keeps hopping then can it still be used to crack WEP using AirSnort becuase that needs to be in monitor mode? and does it mean that, as the last time I done a iwconfig eth0 scan it picked up 4 AP's, it will try and decrypt all of these AP's? I only want to crack my own.