Orinoco Monitor Mode in Knoppix 3.4 with 2.6 kernel

[booty]

I have a Dell 1150 Truemoblie wifi card (ie Orinoco Gold). I can't seem to (ever) get monitor mode to work in airsnort! Oh yeah and Kismet doesn't work either!

When I run knoppix26 to connect to my network I take these steps.
1. Run netcardconfig, select eth0, and dhcp broadcast.
2. Launch wavelan and close netcardconfig (before it fails).
3. I enter my sid and my wep key
4. pump -i eth0 and I'm good.

here is my iwpriv and lsmod it looks like orinoco.cs is loaded (I assume it is the patched version), but as you can see iwpriv does not show monitor:

knoppix@ttyp0[knoppix]$ iwpriv eth0
eth0      Available private ioctl :
          force_reset      (8BE0) : set   0       & get   0
          card_reset       (8BE1) : set   0       & get   0
          set_port3        (8BE2) : set   1 int   & get   0
          get_port3        (8BE3) : set   0       & get   1 int
          set_preamble     (8BE4) : set   1 int   & get   0
          get_preamble     (8BE5) : set   0       & get   1 int
          set_ibssport     (8BE6) : set   1 int   & get   0
          get_ibssport     (8BE7) : set   0       & get   1 int
          dump_recs        (8BFF) : set   0       & get   0

knoppix@ttyp0[knoppix]$ lsmod
Module                  Size  Used by
md5                     8064  1
ipv6                  248320  6
snd_mixer_oss          19200  0
via_agp                 9984  0
sworks_agp             11424  0
sis_agp                 9600  0
nvidia_agp             10140  0
intel_mch_agp          12044  0
intel_agp              18968  1
efficeon_agp           10624  0
ati_agp                10636  0
amd64_agp              12872  0
amd_k7_agp             10124  0
ali_agp                 9600  0
agpgart                32204  11 via_agp,sworks_agp,sis_agp,nvidia_agp,intel_mch_agp,intel_agp,efficeon_agp,ati_agp,amd64_agp,amd_k7_agp,ali_agp
autofs                 19584  1
i810_audio             34704  1
ac97_codec             19840  1 i810_audio
b44                    23680  0
snd_intel8x0m          20228  0
snd_ac97_codec         59396  1 snd_intel8x0m
snd_pcm                87808  1 snd_intel8x0m
snd_timer              26240  1 snd_pcm
snd                    50692  5 snd_mixer_oss,snd_intel8x0m,snd_ac97_codec,snd_pcm,snd_timer
soundcore              12000  3 i810_audio,snd
snd_page_alloc         13188  2 snd_intel8x0m,snd_pcm
parport_pc             38176  0
parport                39104  1 parport_pc
8250                   34208  0
serial_core            23168  1 8250
joydev                 13504  0
evdev                  12416  0
tsdev                   9984  0
hid                    46400  0
af_packet              21636  0
orinoco_cs             11784  1
orinoco                44932  1 orinoco_cs
hermes                 11264  2 orinoco_cs,orinoco
ds                     17920  3 orinoco_cs
yenta_socket           17664  1
pcmcia_core            59136  3 orinoco_cs,ds,yenta_socket
thermal                15760  0
processor              21440  1 thermal
fan                     7564  0
button                  9240  0
battery                12556  0
ac                      8204  0
rtc                    15560  0
cloop                  15456  1
ohci1394               33920  0
ieee1394              305552  1 ohci1394
usb_storage            67072  0
ohci_hcd               20864  0
uhci_hcd               33416  0
usbcore                94420  6 hid,usb_storage,ohci_hcd,uhci_hcd
megaraid               40904  0
ide_cd                 39680  0
ide_scsi               17668  1

knoppix@ttyp0[knoppix]$ kismet
Server options:  none
Client options:  none
Starting server...
Waiting for server to start before startuing UI...
Suid priv-dropping disabled.  This may not be secure.
No specific sources given to be enabled, all will be enabled.
Enabling channel hopping.
Enabling channel splitting.
NOTICE: Disabling channel hopping, no enabled sources are able to change channel.
Source 0 (ciscosource): Enabling monitor mode for cisco source interface eth0 channel 6...
FATAL: Unknown interface eth0: Permission denied

I know a LOT of people use Orinoco Cards so there must be a way or I must be doing something wrong, but I haven't really seen any complaints.

Any help would be great!

Thanks
Booty

[level]

You need to patch your driver to enable monitor mode.

http://airsnort.shmoo.com/orinocoinfo.html

I have the same card and don't have any problems running kismet and airsnort in Knoppix 3.3 (card is patched automatically). Haven't tried Knoppix 3.4.

[booty]

yes in 3.3 my iwpriv shows monitor mode for et0, and kismet seems to work (at least it loads), but I have never been able to get airsnort to work.

could it be a firmware issue? and has anybody that has 3.4 running have problems with their truemobile card? Is the patch installed?

[level]

I just tried Knoppix 3.4 and both kismet and airsnort work.

Monitor mode is listed under iwpriv.

Just reconfigure kismet for orinoco and you should be O.K.

[booty]

but that is the problem on mine it does not show monitor in my iwpriv (as I have shown above).

how/where do I reconfigure kismet and airsnort?

[level]

I should have been more specific in my last post. When I ran it in Knoppix 3.4 I didn't use the 2.6 kernel. Check the airsnort link I gave you, I'm not sure if there is a patch for the 2.6 kernel, yet.

You need to modify the kismet.conf file. I can't recall what directory it's in, do a file search and it should turn up. In the conf file (near the beginning) there is a list of sources kismet can use. The default is for cisco cards. You would comment that out and uncomment the orinoco card.

[booty]

ok well my questions were solely based on the 26 kernel, but thanks for the answer. It looks like you are right 2.6 is not patched yet.

but even with the patched 2.4kernel I have NEVER been able to get airsnort to work. Kismet use to work in 3.3, but not in 3.4 but I'm sure it is due to the config file. can that affect airsnort?

NEWBIE question: how do I change the kismet.config since it is burned on the cd (I don't use a hardware install yet)? Do I have to remaster it?

I'm more concerned about airsnort then kismet as I have never been able to make it work!

thanks,
Booty

[level]

If this works for you then make it into a script and save in your persistent home directory.

sudo rm -rf /etc/kismet/
sudo cp -R /KNOPPIX/etc/kismet /home/knoppix/
sudo ln -s /home/knoppix/kismet /etc/
sudo kedit /etc/kismet/kismet.conf

In Knoppix 3.4, kismet is set up for cisco cards, so as I said in my previous post you'll need to comment that out and uncomment the orinoco. Adjust the interface, eth0, eth1, whatever.

Airsnort should work if kismet does. Make sure you have the right interface and correct source selected from the drop down box.

[Kumagoro]

are there any cheat codes to change it to orinoco on start up?

also how do you create a script?

[Pernic]

Hey guys,
I got airosnort in 3.3 to work but its a roundabout way of doing it

1.At bootloader type "knoppix single" ("knoppix 2" should also work)
2.When booted, type "startx", this will start the GUI (as root)
3.When booted, open a terminal and type "kismet", kismet should start and put card into monitor mode.
4.Start airosnort, select orinoco and eth0 (if eth0 is the orinoco card)
5.Click start and as card is already in monitor mode airsnort has no problems.

This works for me, hope it does for you too.