Knoppix STD and Airsnort

**fblz_no_limit** · 02-15-2004, 09:53 PM

I am trying to get AirSnort working on Linux *Knoppix STD*. I am using a Prism2 based card *Netgear MA401*. The card is found by linux in the bootup section. It loads up some stuff and says Orinico and Prism 2, etc. In Linux it self, If I put "iwpriv eth0*, it shows my Wireless Card and the drop down list includes the word "monitor" listed. When I run the Wireless Config. it finds my Card and asks for some config details etc. I try to run Airsnort, it wont show eth0 in the device, I sleect Prism2 and hit scan, it says cannot put in Monitor Mode. But, when I run "Wellenreiter Wireless Scanner" and leave it on for a bit it finds many BssID's and also sniffs packets. So what do I have to do to get Airsnort to work!? It says needs to be put in Monitor mode... I tried "iwpriv eth0 monitor 1 7" in the Shell Root as well. When I hit return it just starts a new line, so I guess that is ok? What do I have to do to get AirSnort to work?

**fblz_no_limit** · 02-16-2004, 12:13 AM

nvm, problem solved!

**jan_m** · 03-28-2004, 05:48 PM

I'm exact at the same point. MA401 is recognized, started and fails.

What have you done?

**srini88** · 04-13-2004, 04:12 PM

I am a beginner with Linux I am trying to get Airsnort working and I am getting the message that " Could not set to monitor mode". My laptop has an inbuilt Prism card. I also inserted a WaveLan silver PCMCIA card and I got the same message.

Can you tell me what I could try out to fix this issue?

Thanks

**drrignell** · 04-21-2004, 04:17 PM

I sometimes encounter kinda the same problem, usually its enough for me to fill in eth0 (or your equavilent). Otherwise it replies "can not set monitor mode"

**oayz** · 04-23-2004, 03:54 PM

That's how I made it work (using Knoppix-STD):

1. Boot Knoppix
2. Remove 802.11 card
3. Go to Menu/Wireless and click on "orinoco patch"
4. Wait until it's done
5. Insert card back
6. Open terminal window and type:
sudo airsnort &
7. In Airsnort select:
device: eth0
card type: orinoco-cs
8. Click start, you should see list of APs and packets coming

As a sanity check after #5 you can type "iwpriv" in the terminal window and see if "eth0" is listed and has "monitor" item.

You can also mount your hard drive to save/restore airsnort's capture between sessions. Just do "mount /mnt/hda1" in the treminal window. Clicking on HDA1 on the desktop mounts hard drive in Read-Only mode

Good luck!