notes.splitbrain.org - wlan

3comofficeconnect

Anonymous (anonymous@undisclosed.example.com) — 2007-03-27T14:54:20+00:00

2007/03/27 12:27	current
Line 1:	Line 1:
	+	====== 3COM OfficeConnect on Linux======
	+
	+	{{wlan:3com-front.jpg?250}} {{wlan:3com-back.jpg?200}}
	+
	+	The exact name is //3com OfficeConnect 11Mbps Wireless LAN CardBus PC Card//. It's an 32Bit cardbus card and the model number is //3CRSHPW796//. A label on the card says its //Version 1//.
	+
	+	Because this is cardbus card and not a simple PC card it does not show up whith ''cardctl ident'' - instead it is handled by [[:hotplug]] and gets registered as PCI device. ''lspci'' has something to tell:
	+
	+	0000:01:00.0 Network controller: 3Com Corporation 3CRSHPW796 [OfficeConnect Wireless CardBus] (rev 15)
	+	Subsystem: 3Com Corporation 3CRSHPW796 [OfficeConnect Wireless CardBus]
	+	Flags: medium devsel, IRQ 9
	+	I/O ports at 4000 [size=256]
	+	Memory at 10800000 (32-bit, non-prefetchable) [size=1K]
	+	Expansion ROM at 10400000 [size=128K]
	+	Capabilities: [c0] Power Management version 2
	+
	+	===== General Setup =====
	+
	+	I'll use a vanilla Kernel 2.4.26 from www.kernel.org with PCMCIA and Wireless LAN support. In userspace I use the latest ''pcmcia-cs'' (3.2.5-7), ''[[:hotplug]]'' (0.0.20040329-11) and ''wireless-tools'' (26+27pre22-1) packages from [[:Debian]]s unstable branch. Everything is done on my Fujitsu-Siemens [[:Lifebook]].
	+
	+	===== ADMtek Driver =====
	+
	+	There is some info at http://www.espina.info/papers/officeconnect/ stating the card uses an ADMtek chipset. The page describes how to run this card with the half propritary driver provided by ADMtek so I tried that first. You need a patch from this site and the sources from www.admtek.com.tw but I couldn't reach their server :-(. However I found a copy [[http://www.latinsud.com/adm8211/ADM8211_src_105.tar.gz\|here]] (or [[http://freecache.org/http://www.latinsud.com/adm8211/ADM8211_src_105.tar.gz\|through cache]]). So here is what I did following the instructions on the mentioned page.
	+
	+	$> wget http://www.latinsud.com/adm8211/ADM8211_src_105.tar.gz
	+	$> wget http://www.espina.info/papers/officeconnect/ADM8211_src_105.patch
	+	$> tar -xzvf ADM8211_src_105.tar.gz
	+	$> cd ADM8211
	+	$> patch -p0 < ../ADM8211_src_105.patch
	+	#> ln -s /usr/src/linux /usr/src/linux-2.4
	+	$> make
	+	#> cp 8211.o /lib/modules/`uname -r`/pcmcia/
	+	#> depmod -a
	+
	+	The ''depmod'' returns an ''unresolved symbols'' error but adding the following to ''/etc/pcmcia/local.conf'' gave me a new ''eth1'' device:
	+
	+	<file>
	+	device "8211"
	+	class "network" module "8211"
	+
	+	card "3Com Corporation"
	+	manfid 0x10b7,0x6000
	+	bind "8211"
	+	</file>
	+
	+	Even the ''dmesg'' output looked fine:
	+
	+	<code>
	+	cs: cb_alloc(bus 1): vendor 0x10b7, device 0x6000
	+	PCI: Enabling device 01:00.0 (0000 -> 0003)
	+	ADM8211 Linux driver version 1.05 (June 24, 2003)
	+	PCI: Setting latency timer of device 01:00.0 to 64
	+	8211: Hardware Address 00:0B:AC:E6:9C:D8, IRQ 9.
	+	eth1: ADMtek Wireless rev 21 at 0x4000
	+	</code>
	+
	+	Everything looked good but setting the ESSID with ''iwconfig eth1 essid "foo"'' failed. There is no error message but the ESSID gets not set. Some googling brought up [[http://www.linuxquestions.org/questions/showthread.php?postid=1000617#post1000617\|this post]] saying the driver does not work with newer Kernels. Doh! :-/
	+
	+	===== GPL Driver =====
	+
	+	Luckily there is a GPL'd driver available at http://aluminum.sourmilk.net/adm8211/ - it is very new and should be considered as beta. It is developed for the 2.6.x series Kernel but the INSTALL file says it works with 2.4.x, too. So lets try:
	+
	+	$> wget adm8211-20040711.tar.bz2
	+	$> tar -xjvf adm8211-20040711.tar.bz2
	+	$> cd adm8211
	+	$> make
	+	#> make install
	+
	+	Be sure to delete the ''8211.o'' module if you tried the factory driver before. Then insert the card and run ''dmesg'' to check what happens:
	+
	+	cs: cb_alloc(bus 1): vendor 0x10b7, device 0x6000
	+	PCI: Enabling device 01:00.0 (0000 -> 0003)
	+	adm8211: Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>; Copyright 2004, Michael Wu <flamingice@sourmilk.net>
	+	adm8211: release 20040711
	+	PCI: Setting latency timer of device 01:00.0 to 64
	+	eth1: EEPROM type: 93C66
	+	eth1: RFtype=1 BBPtype=1 Specific BBP=0 Transceiver=0
	+	eth1: Channel range: 1-11
	+	eth1: hwaddr 00:0b:ac:e6:9c:d8, IRQ 9, Rev 0x15, PCI ID: 0x82011317, mem @0x10800000 (len=0x400)
	+
	+	Looks nice :-) Lets get it up:
	+
	+	#> iwconfig eth1 essid "MeinKleinesWLAN" key restricted 's:13chars ASCII' mode Managed
	+	#> dhclient eth1
	+
	+	Did it work? Well for me it did :-D. 1:0 for open source :-)
	+
	+
	+	=====3com Driver=====
	+
	+	I just discovered that 3com it self provides a linux for the card at their [[http://www.3com.com/products/en_US/result.jsp?selected=all&sort=effdt&order=desc&sku=3CRSHPW796\|support page]]. It looks a lot like the ADMtek driver but unlike the above mentioned driver it works ;-)
	+
	+	The setup is easy. Get the driver from the support site, unpack compile and install:
	+
	+	$> tar -xzvf 3CRSHPW796.tar.gz
	+	$> cd source
	+	$> make
	+	#> cp adm8201.o /lib/modules/`uname -r`/kernel/drivers/net/wireless/
	+	#> modprobe -a
	+
	+	Running ''depmod'' prints an //Unresolved Symbols// error, but inserting the card loads the driver:
	+
	+	<code>
	+	cs: cb_alloc(bus 1): vendor 0x10b7, device 0x6000
	+	PCI: Enabling device 01:00.0 (0000 -> 0003)
	+	PCI: Setting latency timer of device 01:00.0 to 64
	+	eth1: EEPROM type: 93C66
	+	eth1: RFtype=1 BBPtype=1 Specific BBP=0 Transceiver=0
	+	eth1: Channel range: 1-11
	+	eth1: hwaddr 00:0b:ac:e6:9c:d8, IRQ 9, Rev 0x15, PCI ID: 0x82011317, mem @0x10800000 (len=0x400)
	+	</code>
	+
	+	Again setting your WLAN parameters and getting an IP via DHCP is just two commands away:
	+
	+	#> iwconfig eth1 essid "MeinKleinesWLAN" key restricted 's:13chars ASCII' mode Managed
	+	#> dhclient eth1
	+
	+	Nice. Now you have two different drivers to choose from for this card.

conceptronicc22c

Anonymous (anonymous@undisclosed.example.com) — 2006-11-13T13:48:56+00:00

2006/11/13 12:38	current
Line 1:	Line 1:
	+	====== Conceptronic C22C on Linux ======
	+
	+	{{wlan:concept-front.jpg?250}} {{wlan:concept-back.jpg?200}}
	+
	+	This cards official name is //Wireless 22Mbps PC Card for Notebooks//. It's an 32Bit Cardbus card with the model name //C22C//.
	+
	+	Inserting this card immediatly froze my machine after printing these lines:
	+
	+	cs: cb_alloc(bus 1): vendor 0x104c, device 0x8400
	+	PCI: Enabling device 01:00.0 (0000 -> 0003)
	+
	+	After disabling the cardmanager (''/etc/init.d/pcmcia-cs stop'') and I was able to insert the card without a crash and to reveal the following info with ''lspci -v'':
	+
	+	0000:01:00.0 Network controller: Texas Instruments ACX 100 22Mbps Wireless Interface
	+	Subsystem: Texas Instruments: Unknown device 8401
	+	Flags: medium devsel, IRQ 9
	+	I/O ports at 4000 [size=32]
	+	Memory at 10800000 (32-bit, non-prefetchable) [size=4K]
	+	Memory at 10810000 (32-bit, non-prefetchable) [size=64K]
	+	Capabilities: [40] Power Management version 2
	+
	+	===== General setup =====
	+
	+	I'll use a vanilla Kernel 2.4.26 from www.kernel.org with PCMCIA and Wireless LAN support. In userspace I use the latest ''pcmcia-cs'' (3.2.5-7), ''[[:hotplug]]'' (0.0.20040329-11) and ''wireless-tools'' (26+27pre22-1) packages from [[:Debian]]s unstable branch. Everything is done on my Fujitsu-Siemens [[:Lifebook]].
	+
	+	===== The acx100 driver =====
	+
	+	A GPL'd driver for the TI chipset is available here: http://acx100.sourceforge.net/
	+
	+	$> wget http://switch.dl.sourceforge.net/sourceforge/acx100/acx100-0.2.0pre8.tar.bz2
	+	$> tar -xjvf acx100-0.2.0pre8.tar.bz2
	+	$> cd acx100-0.2.0pre8
	+
	+	So far so easy. The driver needs a firmware which is, for legal reasons, not included in the download. This firmware can be extracted from the windows drivers (available at [[http://www.conceptronic.net/support/file_list01.asp?g=9&p=C22C&t=dr\|conceptronic.net]]) or you can let the Makefile fetch and extract the needed firmware from the net. I go for the latter:
	+
	+	$> make fetch_firmware
	+
	+	Now compile and install
	+
	+	$> make
	+	#> make install
	+
	+	Inserting the card no longer freezes the machine even with the cardmanager running but ''dmesg'' shows still some errors:
	+
	+	<code>
	+	cs: cb_alloc(bus 1): vendor 0x104c, device 0x8400
	+	PCI: Enabling device 01:00.0 (0000 -> 0003)
	+	acx100: It looks like you were coaxed into buying a wireless network card
	+	acx100: that uses the mysterious ACX100 chip from Texas Instruments.
	+	acx100: You should better have bought e.g. a PRISM(R) chipset based card,
	+	acx100: since that would mean REAL vendor Linux support.
	+	acx100: Given this info, it's evident that this driver is quite EXPERIMENTAL,
	+	acx100: thus your mileage may vary. Visit http://acx100.sf.net for support.
	+	acx100_init_module: dev_info is: TI acx_pci
	+	acx100_init_module: TI acx_pci.o: Ver 0.2.0pre8 Driver initialized, waiting for cards to probe...
	+	PCI: Setting latency timer of device 01:00.0 to 64
	+	Found ACX100-based wireless network card at 01:00.0, irq:9, phymem1:0x10800000, phymem2:0x10810000, mem1:0xd096c000, mem1_size:4096, mem2:0xd096e000, mem2_size:65536.
	+	acx100_probe_pci: using ACX100 io resource addresses (size: 54)
	+	hw_unavailable = 1
	+	reset hw_unavailable++
	+	acx100_reset_mac: enable soft reset...
	+	acx100_reset_mac: disable soft reset and go to init mode...
	+	ERROR: no directory for firmware file specified, ABORTING. Make sure to set module parameter 'firmware_dir'! (specified as absolute path!)
	+	acx100_reset_dev: Failed to upload firmware to the ACX100
	+	acx100_probe_pci: TI acx_pci: MAC initialize failure!
	+	acx100_probe_pci: TI acx_pci.o: Ver 0.2.0pre8 Loading FAILED
	+	</code>
	+
	+	Obviously it fails to load the firmware. The location of the firmware files has to be given as module parameter. First lets copy the firmware files downloaded by ''make fetch_firmware'' to some sane place. I suggest ''/usr/local/share/acx100-firmware''.
	+
	+	#> mkdir -p /usr/local/share/acx100-firmware
	+	#> cp firmware/*.BIN /usr/local/share/acx100-firmware/
	+
	+	Now we need to tell modprobe were we put it. For the [[Debian]] way we just create a new file called ''/etc/modutils/acx_wlan'' with the following content:
	+
	+	<file>
	+	options acx_pci firmware_dir=/usr/local/share/acx100-firmware/
	+	</file>
	+
	+	Then run ''update-modules'' as root.
	+
	+	Note: For 2.6.x Kernel you have to put this file in the ''/etc/modprobe.d'' directory.
	+
	+	Now inserting the card loads the driver with the right firmware and registers a ''wlan0'' device to work with:
	+
	+	#> iwconfig wlan0 essid "MeinKleinesWLAN" key restricted 's:13chars ASCII' mode Managed
	+	#> dhclient wlan0
	+
	+	Another card with wicked hardware mastered :-)

netgearma401

Anonymous (anonymous@undisclosed.example.com) — 2007-09-19T06:05:03+00:00

2007/09/18 08:52	current
Line 1:	Line 1:
	+	====== Netgear MA401 on Linux======
	+
	+	{{wlan:netgear-front.jpg?250}} {{wlan:netgear-back.jpg?100}}
	+
	+	This is my old card called //802.11b Wireless PC Card//. It's an 16Bit PCMCIA card with the model name //MA401//. A small label on the backside calls it //Rev. D//.
	+
	+	Here is what ''cardctl ident'' says :
	+
	+	product info: "NETGEAR MA401RA Wireless PC", "Card", "ISL37300P", "Eval-RevA"
	+	manfid: 0x000b, 0x7300
	+	function: 6 (network)hh
	+
	+	The card has a Prism 2.5 chipset which is well supported by various drivers including the Kernels ''orinoco_cs'' and the [[http://hostap.epitest.fi/\|hostap]] driver. I used it with the latter one and upgraded the firmware following [[http://linux.junsun.net/intersil-prism/\|Jun Sun's HOWTO]]. The card workes fine for some time but then suddenly freezes. Even ejecting and reinserting doesn't help. This occurs under Windows as well.
	+
	+	To get the cardmanager to recognize the card put this in your ''/etc/pcmcia/local.conf''. For the host_ap driver just replace ''orinoco_cs'' with ''hostap_cs''.
	+
	+	<file>
	+	card "NETGEAR MA401RA Wireless PC"
	+	manfid 0x000b, 0x7300
	+	bind "orinoco_cs"
	+	</file>
	+
	+	I was not able to get it running on Kernel 2.6.7. The orinoco_cs driver was unable to read it's MAC address and took the firmware version for 0.0.0 :-o. The hostap driver did compile but froze the whole machine on inserting the card.

orinocosilver

Anonymous (anonymous@undisclosed.example.com) — 2006-11-27T22:11:14+00:00

2006/11/27 20:38	current
Line 1:	Line 1:
	+	====== Proxim Orinoco Silver ======
	+
	+	{{wlan:proxim-front.jpg?250}} {{wlan:proxim-back.jpg?100}}
	+
	+	The exact name is //Proxim ORiNOCO 802.11b PC Card Silver//. It's an 16Bit PCMCIA card and the model number is //8421-WD//. The package says it's //Revision D//. This is important. Older cards were very well supported in linux but this one isn't. You'll see...
	+
	+	Let's see what ''cardctl ident'' can tell us:
	+
	+	product info: "Agere Systems", "Wireless PC Card Model 0110", "", ""
	+	manfid: 0x0156, 0x0003
	+	function: 6 (network)
	+
	+	Okay it's an Agere chipset which should be supported by the Kernels ''orinoco_cs driver''. But my 2.4.26 is not able to run the card:
	+
	+	<code>
	+	hermes.c: 4 Dec 2002 David Gibson <hermes@gibson.dropbear.id.au>
	+	orinoco.c 0.13d (David Gibson <hermes@gibson.dropbear.id.au> and others)
	+	orinoco_cs.c 0.13d (David Gibson <hermes@gibson.dropbear.id.au> and others)
	+	eth1: Station identity 0015:0002:0001:000a
	+	eth1: Looks like an Intersil firmware version 1.10.2
	+	eth1: Ad-hoc demo mode supported
	+	eth1: IEEE standard IBSS ad-hoc mode supported
	+	eth1: WEP supported, 104-bit key
	+	hermes @ IO 0x200: Truncating LTV record from -2 to 6 bytes. (rid=0xfc01, len=0x0000)
	+	eth1: MAC address 15:00:02:00:01:00
	+	hermes @ IO 0x200: Truncating LTV record from -2 to 34 bytes. (rid=0xfc0e, len=0x0000)
	+	eth1: Station name ""
	+	hermes @ IO 0x200: Truncating LTV record from -2 to 2 bytes. (rid=0xfd10, len=0x0000)
	+	hermes @ IO 0x200: Truncating LTV record from -2 to 2 bytes. (rid=0xfc06, len=0x0000)
	+	hermes @ IO 0x200: Truncating LTV record from -2 to 2 bytes. (rid=0xfc83, len=0x0000)
	+	hermes @ IO 0x200: Truncating LTV record from -2 to 2 bytes. (rid=0xfc82, len=0x0000)
	+	hermes @ IO 0x200: Truncating LTV record from -2 to 2 bytes. (rid=0xfc0c, len=0x0000)
	+	hermes @ IO 0x200: Truncating LTV record from -2 to 2 bytes. (rid=0xfc0d, len=0x0000)
	+	eth1: firmware ALLOC bug detected (old Symbol firmware?). Trying to work around... failed!
	+	eth1: Error -5 allocating Tx buffer
	+	orinoco_cs: register_netdev() failed
	+	orinoco_lock() called with hw_unavailable (dev=ca2c6800)
	+	</code>
	+
	+	This [[http://sourceforge.net/mailarchive/message.php?msg_id=5492422\|mailinglist message]] sums up what happened to the card. Looks like the only way to go is the binary driver available at [[http://www.agere.com/support/drivers/\|Agere's website]]. Alas, that driver is only available for 2.4 kernels.
	+
	+	You need to get the source of the [[http://pcmcia-cs.sourceforge.net\|pcmcia-cs utilities]] to compile their driver. But you can still use your distributions user space tools and the kernels builtin PCMCIA support afterwards.
	+
	+	$> wget http://ovh.dl.sourceforge.net/sourceforge/pcmcia-cs/pcmcia-cs-3.2.8.tar.gz
	+	$> tar -xzvf pcmcia-cs-3.2.8.tar.gz
	+
	+	Then get and unpack the files from [[http://www.agere.com/support/drivers/\|Agere's website]] on top of the pcmcia sources:
	+
	+	$> cd pcmcia-cs-3.2.8/
	+	$> wget http://www.agere.com/support/drivers/wl_lkm_720_abg.tar.gz
	+	$> tar -xzvf wl_lkm_720_abg.tar.gz
	+
	+	Now run the ''Configure'' script answering the questions (using the default anwsers should suffice). Then run the scripts ''Build'' and ''Install'' provided by Agere instead of doing the usual ''make'':
	+
	+	$> ./Configure
	+	$> ./Build
	+	#> ./Install
	+
	+	Inserting the card should load the ''wlags49_h2_cs''; restart pcmcia if necessary via ''/etc/init.d/pcmcia restart'' (or a similar command). You should have an ''eth1'' device. Set up your WLAN parameters and you should be online.
	+
	+	#> iwconfig eth1 essid "MeinKleinesWLAN" key 's:13chars ASCII' mode Managed
	+	#> dhclient eth1
	+

wlan

Anonymous (anonymous@undisclosed.example.com) — 2008-01-11T13:52:38+00:00

2008/01/11 13:52	current
Line 1:	Line 1:
	+	====== Wireless LAN ======
	+
	+	* [[wlanaudit\|WLAN Auditing]]
	+
	+	===== Wireless LAN cards on Linux =====
	+
	+	* [[NetgearMA401]]
	+	* [[3comOfficeConnect]]
	+	* [[ConceptronicC22C]]
	+	* [[OrinocoSilver]]

wlanaudit

Anonymous (anonymous@undisclosed.example.com) — 2008-04-01T14:28:50+00:00

2007/12/08 04:17	current
Line 1:	Line 1:

	+
	+	======WLAN Security Auditing======
	+
	+	To check how secure our companys Wireless LAN is I tried different wardriving
	+	tools. Here is a short roundup.
	+	======Kismet======
	+	Hallo!!!
	+	Kismet scans for available networks and gives you some interesting information
	+	about them.
	+
	+	#> apt-get -t testing install kismet
	+
	+	You may need to edit the ''/etc/kismet/kismet.conf'' to match your wireless NIC
	+	and the driver you use. I'm running the hostap driver on my [[NetgearMA401\|Netgear MA401]] (Prism
	+	2.5) so this is the line I use:
	+
	+	source=prism2_hostap,wlan0,prism2source
	+
	+	You need to be root to run kismet. When started it gathers information about the
	+	available networks in an "Autofit" called mode. To actually select an
	+	interesting network (eg. your own) press ''s'' to sort the list by a key of your
	+	choice, then select the network and press ''i'' for more information.
	+
	+	Make sure your network has WEP encryption enabled. It is possible to hide the
	+	name of your network (SSID hiding) -- however kismet will detect it nontheless it
	+	will show it as "cloaked".
	+
	+	Kismet logs received packets to ''/var/log/kismet/'' which will come in handy
	+	later.
	+
	+	=====AirSnort=====
	+
	+	The next tool to use is AirSnort. This is a GTK based networksniffer similar to
	+	kismet but able to break WEP encryption. Install it and run it as root.
	+
	+	#> apt-get -t testing install airsnort
	+
	+	Some theory first. WEP uses the RC4 Algorithm which isn't the safest in world.
	+	In fact it has some known security flaws which are described [[http://www.drizzle.com/%7Eaboba/IEEE/rc4_ksaproc.pdf\|elsewhere]].
	+	Simply put, there are a few thousand keys which are weak and easy to
	+	decrypt. A few years ago you just had to run a tool like AirSnort to crack WEP
	+	encrption in a few minutes by fetching these weak keys from the air.
	+
	+	Well nowadays all manufactuers have changed their WEP implementations to avoid
	+	these weak keys so AirSnort will need a large amount of Packets to get the WEP password. If you
	+	get a lot of "interesting" packets in AirSnort you know there is some old
	+	Hardware in your net which needs to be updated.
	+
	+	Update: I haven't tried it yet but there is a simple way to get the huge amount of packets you need: Capture a few (correctly encrypted) packetets from the air and then reinject them in the network. Other hosts will answer generating the wanted traffic to sniff. So if you need to protect important stuff do not rely on WEP!
	+
	+	=====WepAttack=====
	+
	+	Even if the manufacturers don't use the weak keys in WEP anymore there is room
	+	for an simple attack: Using brute force to guess the WEP password. The
	+	interesting thing is that this can be done completely undetected. All that is
	+	needed is a single passively sniffed packet.
	+
	+	Lets install the tool first. Get it from http://wepattack.sourceforge.net and
	+	unpack it. For compiling you need some libraries, too.
	+
	+	#> apt-get -t testing install libssl-dev libpcap-dev
	+	$> tar -xzvf WepAttack-0.1.3.tar.gz
	+	$> cd WepAttack-0.1.3/src/
	+	$> make
	+	#> cp wepattack /usr/local/bin/
	+
	+	To brute force attack a WEP encrypted packet you need a wordlist (available
	+	from the above site) and a packet dump from kismet. Then just run the following
	+	command.
	+
	+	$> wepattack -f /var/log/kismet/Kismet-<date>-<num>.dump -w wordlist
	+
	+	If this finds your password it is too weak.
	+
	+	===== Summary =====
	+
	+	If your WLAN passes all these tests it should be considerably safe from most
	+	occasional crackers. At our company all traffic to the internal LAN is additionally
	+	encrypted by IPSEC, but for a home network this may be fine enough even without using stronger encryption.