THE BLOG ★ Ramblings on WiFi & stuff.

What is RF Monitor-Mode & Why Does It Matter?

In a previous article I did a high-level overview of what wireless site surveys are and what they are used for. In this article I'll dive in a little deeper to give some insight on what packet captures and RF Monitor-Mode are, are and what they can reveal.

There are two modes a wireless NIC can be in - connected/disconnected, and monitor-mode. Connected is exactly what it sounds like - the NIC is connected, or in 802.11 parlance, "Associated", to an access point. When a device is associated it can transmit/receive data through the AP. This is how most people experience Wi-Fi - associated to an AP, doing whatever it is they are doing - watching Netflix, sending an e-mail, upload a file to a server, etc.

Monitor-mode, or "RF" monitor-mode implies you are not associated/connected to the WLAN, so you are DISCONNECTED, but you are LISTENING, or "monitoring". This mode is often not simple to achieve. It requires the ability to manipulate the wireless driver to set the NIC into this mode. Monitor-mode allows the wireless NIC to listen to a specific channel, a set of channels, or ALL the channels in 2.4/5GHz.

Also, if you cannot place your NIC into monitor-mode you cannot see wireless frames. When you are associated/connected to a WLAN, all you can see are the upper layer data flow. This would include things like DHCP, IP addresses, DNS, webpages, etc. That may be fine if you are looking to troubleshoot something in the network, for YOUR device, but not so much if you are trying to troubleshoot a WIRELESS/802.11 problem in the AIR.

Everything I've highlighted so far is related to what we call wireless PACKET CAPTURE. The purpose of a packet capture is to "capture" all the data transpiring during the error you are troubleshooting. You can then review the data in your chosen packet analysis software and dig in to potentially discover the reason for the problem your device is experiencing.

The most common use-case for monitor-mode is to perform wireless packet captures. This can be difficult to achieve. You need specific hardware, and custom drivers, that allow the NIC to use this mode. For Windows, this is almost impossible with the built-in adapter. Mainly due to the fact that there is no standardized NIC that all Windows machine use, so you are often left with researching and purchasing a 3rd party adapter that can use monitor-mode. Even then, the adapter you may have limitations of what information it can actually present to you. So, you wind up purchasing and testing several adapters until you find the one that works best for you intended use.

For Windows, the best results can be found by using 3rd party software, and their recommended adapters. With limited success, Wireshark 3.0 and newer, will allow for monitor-mode captures with some adapters. I have a video on how to do this on YouTube. Commercial software such as MetaGeek Eye P.A., TamoSoft, CommView for WiFi, and LiveAction’s Omnipeek are popular and easier to implement.

On Linux and MacOS, things are a bit better. Specifically, macOS, since the NICs used are limited across the platform, and the OS is based of a UNIX variant, you can set the internal adapter to monitor-mode at will. This makes Macs a favorite among some wireless engineers, along with Linux, of course. One caveat, the new M1 MacBooks use a new 802.11ax adapter that does not render monitor-mode data correctly when capturing on 80MHz channels, so until that is resolved, only pre-M1 Macs are reliable for 80MHz captures.

So, Monitor-Mode is critical for doing in-depth 802.11 analysis. Like troubleshooting why a particular device, or application, is not performing as expected, or validating if that client, or application is functioning as expected. 

I think of packet captures as more of a “micro-level” tool, as opposed to say a wireless site survey which is more of a “macro-level” tool. In other words, if the issue is “our Wi-Fi sucks”, or general wireless malaise, then doing a wireless survey is most appropriate. If the issue is with a specific device, application, or set of devices, I may focus on packet captures to see what specifically is going on with those devices or applications.

For more on performing wireless packet captures see my YouTube channel.

Ways to Do Wireless Packet Capture on Windows by Cost

Help ME, Help YOU, Help ME!!!! (Or, How Apple Broke Wireless PCAPs on the M1 Macs)

I need your help! The new M1 Macs seems to have broken wireless packet capture. Macs have been a go to tool for many wireless engineers because of the ease of native wireless pcaps. Now, it’s broken.

Can y'all help a brother out and do some testing on your M1s and see if you're getting the same results?

Even better, can you SEND me your pcap (if you are so inclined)?

Thanks! 😃

Ep. 004: PCAP'n with Eddie! Multi Channel Wireless Packet Capture on the LINUX!

Now we move on to Linux! Learned myself how to do multi-adapters on Ubuntu with Wireshark. I am sooooo excited!😬 There's more. ⬇

Ubuntu 2019.3

Wireshark 3.0.5

Netgear A6210

HANDY COMMANDS:

INSTALL AIRCRACK-NG

sudo apt-get update

sudo apt-get install aircrack-ng

SET NICS TO MONITOR MODE

sudo airmon-ng check (Checks for possible interfering processes.)

sudo airmon-ng check kill (Kill ‘dem processes!)

sudo airmon-ng start interface-name (Start monitor mode)

sudo airmon-ng stop interface-name (Stop monitor mode)

START NETWORK MANAGER

sudo systemctl start NetworkManager.service

REMOVE AVAHI-DAEMON

sudo apt purge avahi-daemon

CAN'T CAPTURE IN WIRESHARK?! 😱

sudo dpkg-reconfigure wireshark-common
(press the right arrow and enter for yes)

sudo chmod +x /usr/bin/dumpcap

Ep. 003: PCAP’n with Eddie! Multi-Channel Captures in Windows

Due to a recent “snafu” with my Omnipeek licensing, I was on the hunt for multi-channel packet capture alternatives. I believe these two options are currently the best and easiest way, to do this on Windows.

Yes, you can do this with the Ekahau Sidekick, but a.) it requires a Sidekick, and 2.) you can really only do two channels (any more and the two internal NICs start channel hopping). Below are the items you'll need. 

EDIMAX 7833UAC (3-Stream, USB 3.0, 11ac NICs)

METAGEEK EYE P.A.

COMMVIEW FOR WIFI

Ep. 002: PCAP'n w/ Eddie! Wireless packet capture on the Windows!

Basic intro on how to do a wireless (Wi-Fi) packet capture on Windows, on the cheap, using Wireshark 3.0 and the Netgear A6210. IMPORTANT  STUFF!👇

TABLE OF CONTENTS:

01:54 - Wireshark installation particulars.

04:01 - Supported NICs

07:05 - Putting NIC in RF Monitor Mode

09:31 - Setting the channel to capture on

STUFF:

Wireshark 3.x

Netgear A6210

IMPORTANT! You MUST install the Netgear drivers, to you will not be able to capture on any UNII-2 channels. Download the drivers here - https://tinyurl.com/y23xdl3r

The 802.1X Process (as told by Luis.)

In case you missed my WLPC Wireshark talk here’s the 802.1X process file… with COMMENTS.😬

It’s just the specific frames in the 802.1X process saved into a separate file with comments for each of the frames. Hopefully, it will give an decent understanding of what is actually happening during this process. ENJOY!

The great Michael Peńa.

The great Michael Peńa.

Here’s that actual .pcapng file for your use.

And if you’re interested in the SLIDES they’re here.

Options for Wireless Packet Capture in Windows

UPDATED: 05/28/2019

HOLD THE PRESSES!!! So, as of Wireshark 3.0, you can do RF Monitor mode captures in Windows using inexpensive NICs. Specifically, the Netgear A6210. Here’s write up on how to set this up, but nothing special is required other than Wireshark 3.0, or newer, and a supported NIC (Netgear A6210).

So, of course, this comes with some caveats. The main one is that this does not support channel information. So, while you CAN set the channel you want to capture on, there will be no data in the capture confirming you are indeed on that channel.

WiFiXax has a blog post on howe to do it.

You can go ahead and read the rest of this post, but at this point, why would you? ¯\_(ツ)_/¯

In Windows, you cannot effectively analyze wireless frames, because you are unable to put the wireless NIC in "RF Monitor Mode" - that is the mode in which the wireless NIC can see ALL 802.11 frames in the air, not just ones intended for itself.

Historically, it's been an expensive proposition. There are some great tools out there like OmniPeek (which I use), the gold standard for Windows packet analysis. And for years, AirPcap Nx was the main NIC folks used for pcap'ing WLANs with Wireshark. Unfortunately, both options are pricey. And the AirPcap NX is no longer manufactured. You’d be lucky to find a used one on eBay. Linux and MacOS have been the only ways to cheaply get access to RF Monitor mode without spendy software and hardware, like Omnipeek and the AirPcap Nx.

But, not everyone uses Linux, or Mac OS. Fortunately, and fairly recently, there are more and more ways to get RF Monitor mode in Windows. Here are some relatively inexpensive options (NOT an exhaustive list) to perform an RF Monitor Mode wireless packet capture in Windows using relatively inexpensive hardware.

OR, you could just get a Mac and do it natively. 😉

Lastly, if you have access to an Ekahau Sidekick, and you have an Ekahau Connect account, you can use the Sidekick to perform offline packet captures, and you can even have each NIC capture on a difference channel! Cool!

* If anyone has additional relatively inexpensive options for this list please DM me @HeyEddie. 


"relatively inexpensive"

def.

I don't know. Less than a grand? Less than $500? Please don't get all pedantic on me. 😉