Hello all,

I have an issue in trying to get a Cisco Airo Card (Mini-PCI) on IBM T40 Notebook to get into RFMON mode on Fedora Core 2 running Kernel 2.6.5-1.327.

The driver seems to work great but when I put it in RFMON mode by issuing:

echo 'Mode: r' > /proc/driver/aironet/eth1/Config
echo 'Mode: y' > /proc/driver/aironet/eth1/Config

I get:

cat /proc/driver/aironet/eth1/Config:

Mode: yna (any) bss rfmon
Radio: on
NodeName:
PowerMode: CAM
DataRates: 2 4 11 22 0 0 0 0
Channel: 6
XmitPower: 100
LongRetryLimit: 16
ShortRetryLimit: 16
RTSThreshold: 2312
TXMSDULifetime: 5000
RXMSDULifetime: 10000
TXDiversity: both
RXDiversity: both
FragThreshold: 2312
WEP: open
Modulation: cck
Preamble: short

However that is where my probelm starts. I cannot collect anything via ethereal. Airsnort dies when I select other and hit scan and Kismet renders the following:


NOTICE: Disabling channel hopping, no enabled sources are able to change channel.
Source 0 (ciscosource): Enabling monitor mode for cisco source interface eth1 channel 6...
Source 0 (ciscosource): Opening cisco source interface eth1...
FATAL: pcap reported netlink type 1 (EN10MB) for eth1. This probably means you're not in RFMON mode or your drivers are reporting a bad value. Make sure you have the correct drivers and that entering monitor mode succeeded.

Do I need different drivers or am I doing something wrong.

Any help is appreciated very much.

Thank you,

Babak Pasdar

Anyone...... Anyone.......

Same problem here. This worked for me - edit kismet.conf and change the source to something like the following:

source=cisco_wifix,eth0:wifi0,ciscosource


"If it's not Scottish... IT'S CRAP!!"

I am having the exact same issue. Does your airsnort throw a segmentation fault when it dies?

I read somewhere on google that the 2.6.7rc2 kernel has RFMON enabled drivers for the aironet 3xx cards. I am in the process of throwing the drivers from the 2.4.20 kernel into my 2.6.6 kernel tree and recompiling to see if that works. I will track down the 2.6.7rc2 ones too and also give that a whirl.


Does the ACU utility allow me to do do LEAP authentication even though i am not using Ciscos driver package?


Cisco needs to get up to speed with their linux packages. Almost all auditing firms use linux and cisco, and they/we are a large part of their business.






"Ye Aint hooligenen proper unless ye woken up on ye own vomit"

PLEASE HELP

I'm having the same problem only with a T30 running Slackware and a 2.6.8.1 vanilla kernel. Airsnort just sits there. Ethereal doesn't collect any packets at all. Kismet dies with the "pcap reported netlink type 1 (EN10MB)" error. I'm using the kernel drivers and the latest libpcap (0.8.3). My card firmware version is 5.30.17, listed on the Cisco as the latest known to work in Linux.

I have tried the following:
all of which change /proc/driver/aironet/eth1/Config's mode line after which I can no longer send packets however nothing appears to be captured either. Furthermore iwconfig continues to list the device as being Managed, it never changes to Monitor.

Any assistance would be GREATLY appreciated, I'm giving a presentation on wireless (in)security this Thursday and a live demonstration would drive it home. Thanks for everyone time and effort.

Moved: This thread is more suitable in Wireless Networking and has been moved accordingly to help your thread/question get the exposure it deserves.

bump

Anybody? I get the same error on my debian system running kernel 2.6.8
I can't get wellenreiter to work either...

same issue... toshiba satellite, slack 10, 2.6.8.1 . I can only even see an accesspoint after running kismet.. but kismet fails at the same place your guys does. Funny how then I can only see an ap.


I put in the airo-linux drivers into 2.6.8.1 tree... worked when I booted it up.. rebooted.. stopped working.,



Ugh.

source=cisco_wifix,eth0:wifi0,ciscosource

wowa.. kismet loaded up now after doing that to the config.