OpenWrt Forum Archive

Topic: WiFi packet sniffing?

The content of this topic has been archived on 30 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

I've successfully installed Kamikaze 8.09 on my Netgear WGT634U with the intention of configuring it as a WiFi packet sniffer. I have access to the serial port and I would like to dump WiFi packets onto the serial port. Currently, I've been trying to use tcpdump, but I'm open to anything that will do the job. The closest I've come is the following:

1) Remove the 'option disabled' line from the /etc/config/wireless file fore wifi0.
2) run the following
- wlanconfig ath0 destroy
- wlanconfig ath0 create wlandev wifi0 wlanmode monitor
- ifconfig ath0 up
- tcpdump -i ath0

This doesn't work quite as expected, since it stops after a while and also because the information is a little too low-level for me. I'm looking for something more on the packet level, similar to what would happen if I ran tcpdump on the WAN device (eth0). Any advice would be appreciated. Thanks.

I've come up with another idea. I think I could solve this problem if I could reverse the roles of the WAN port and the wifi card (that is, have the router forward packets received over wifi to the ethernet ports). Though I'm not concerned about actually putting the packets out on the ethernet ports, I imagine this would be done by configuring the wifi0 device exactly as the ethernet devices are configured.

[Edit]
Is there a way to get DHCP to run from the wifi device?

Also, is there a reason why it says the 'nvram' command is not found? Do the files in /etc/config/ take its place?
[/Edit]

(Last edited by nevsan on 21 Apr 2009, 06:16)

As far as I have seen the WGT634U have an USB port and in that case shouldn't it be easier to sniff with tcpdump (or tshark) and store the data on an USB stick connected to the USB port on the router?

However I do it, I still can't set it up to get the information I need. The reason I had used the serial port is because I'm feeding the data to a microprocessor. Thanks, though.

(Last edited by nevsan on 21 Apr 2009, 18:00)

The discussion might have continued from here.