← Documents Documentation/networking/mac80211-injection.rst GitHub 원문 ↗

Linux 6.18.37 · Networking

How to use packet injection with mac80211

monitor mode에서 radiotap·802.11 header·payload를 조합해 packet을 주입하고 송신 조건을 제어하는 방법입니다.

Source pathDocumentation/networking/mac80211-injection.rst
Source versionLinux v6.18.37
TranslationDUJINLABS 전문 번역 + 해설

요약·해설과 원문, 전문 번역을 서로 분리했습니다. API 이름, symbol, source path는 원문 표기를 사용합니다.

1. 요약·해설

원문의 핵심 논리와 kernel programming 관점의 보충 설명입니다. 아래의 전문 번역과는 별도로 작성했습니다.

요약·해설

mac80211-injection.rst:1-106

Radiotap header가 FCS, encryption, fragmentation, ACK, rate, MCS/VHT와 retry를 지정하고 뒤의 IEEE 802.11 header와 payload가 실제 frame을 구성합니다. 완성한 buffer는 monitor interface의 socket 또는 libpcap으로 전송합니다.

2. 영어 원문 전체

번역 기준이 된 Linux v6.18.37 원문입니다. 줄 번호는 이 버전의 파일 좌표입니다.

원문 전체 펼치기
1 .. SPDX-License-Identifier: GPL-2.0
2
3 =========================================
4 How to use packet injection with mac80211
5 =========================================
6
7 mac80211 now allows arbitrary packets to be injected down any Monitor Mode
8 interface from userland. The packet you inject needs to be composed in the
9 following format::
10
11 [ radiotap header ]
12 [ ieee80211 header ]
13 [ payload ]
14
15 The radiotap format is discussed in
16 ./Documentation/networking/radiotap-headers.rst.
17
18 Despite many radiotap parameters being currently defined, most only make sense
19 to appear on received packets. The following information is parsed from the
20 radiotap headers and used to control injection:
21
22 * IEEE80211_RADIOTAP_FLAGS
23
24 ========================= ===========================================
25 IEEE80211_RADIOTAP_F_FCS FCS will be removed and recalculated
26 IEEE80211_RADIOTAP_F_WEP frame will be encrypted if key available
27 IEEE80211_RADIOTAP_F_FRAG frame will be fragmented if longer than the
28 current fragmentation threshold.
29 ========================= ===========================================
30
31 * IEEE80211_RADIOTAP_TX_FLAGS
32
33 ============================= ========================================
34 IEEE80211_RADIOTAP_F_TX_NOACK frame should be sent without waiting for
35 an ACK even if it is a unicast frame
36 ============================= ========================================
37
38 * IEEE80211_RADIOTAP_RATE
39
40 legacy rate for the transmission (only for devices without own rate control)
41
42 * IEEE80211_RADIOTAP_MCS
43
44 HT rate for the transmission (only for devices without own rate control).
45 Also some flags are parsed
46
47 ============================ ========================
48 IEEE80211_RADIOTAP_MCS_SGI use short guard interval
49 IEEE80211_RADIOTAP_MCS_BW_40 send in HT40 mode
50 ============================ ========================
51
52 * IEEE80211_RADIOTAP_DATA_RETRIES
53
54 number of retries when either IEEE80211_RADIOTAP_RATE or
55 IEEE80211_RADIOTAP_MCS was used
56
57 * IEEE80211_RADIOTAP_VHT
58
59 VHT mcs and number of streams used in the transmission (only for devices
60 without own rate control). Also other fields are parsed
61
62 flags field
63 IEEE80211_RADIOTAP_VHT_FLAG_SGI: use short guard interval
64
65 bandwidth field
66 * 1: send using 40MHz channel width
67 * 4: send using 80MHz channel width
68 * 11: send using 160MHz channel width
69
70 The injection code can also skip all other currently defined radiotap fields
71 facilitating replay of captured radiotap headers directly.
72
73 Here is an example valid radiotap header defining some parameters::
74
75 0x00, 0x00, // <-- radiotap version
76 0x0b, 0x00, // <- radiotap header length
77 0x04, 0x0c, 0x00, 0x00, // <-- bitmap
78 0x6c, // <-- rate
79 0x0c, //<-- tx power
80 0x01 //<-- antenna
81
82 The ieee80211 header follows immediately afterwards, looking for example like
83 this::
84
85 0x08, 0x01, 0x00, 0x00,
86 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
87 0x13, 0x22, 0x33, 0x44, 0x55, 0x66,
88 0x13, 0x22, 0x33, 0x44, 0x55, 0x66,
89 0x10, 0x86
90
91 Then lastly there is the payload.
92
93 After composing the packet contents, it is sent by send()-ing it to a logical
94 mac80211 interface that is in Monitor mode. Libpcap can also be used,
95 (which is easier than doing the work to bind the socket to the right
96 interface), along the following lines:::
97
98 ppcap = pcap_open_live(szInterfaceName, 800, 1, 20, szErrbuf);
99 ...
100 r = pcap_inject(ppcap, u8aSendBuffer, nLength);
101
102 You can also find a link to a complete inject application here:
103
104 https://wireless.wiki.kernel.org/en/users/Documentation/packetspammer
105
106 Andy Green <[email protected]>
107

3. 한국어 전문 번역

영어 원문의 문단 순서와 의미를 유지한 전체 번역입니다. 코드, 함수명, symbol과 URL은 원문 표기를 유지합니다.

주입 packet 형식

1-16

mac80211은 사용자 공간이 monitor mode interface를 통해 임의 packet을 주입하도록 지원합니다. buffer는 radiotap header, IEEE 802.11 header, payload 순서로 구성해야 합니다. radiotap 형식 자체는 `Documentation/networking/radiotap-headers.rst`를 참조합니다.

Injection frame layout
Radiotap headerIEEE 802.11 headerPayload

원문의 3단 packet 구조를 정리했습니다.

.. SPDX-License-Identifier: GPL-2.0

=========================================
How to use packet injection with mac80211
=========================================

mac80211 now allows arbitrary packets to be injected down any Monitor Mode
interface from userland.  The packet you inject needs to be composed in the
following format::

 [ radiotap header  ]
 [ ieee80211 header ]
 [ payload ]

The radiotap format is discussed in
./Documentation/networking/radiotap-headers.rst.

Radiotap 송신 제어 field

17-71

정의된 radiotap parameter 대부분은 수신 packet에만 의미가 있습니다. 주입 경로는 `IEEE80211_RADIOTAP_FLAGS`에서 FCS 제거·재계산, 사용 가능한 key로 WEP encryption, 현재 fragmentation threshold를 넘는 frame 분할을 제어합니다.

`IEEE80211_RADIOTAP_TX_FLAGS`의 `F_TX_NOACK`는 unicast라도 ACK를 기다리지 않게 합니다. 자체 rate control이 없는 device에서는 `IEEE80211_RADIOTAP_RATE`로 legacy rate, `IEEE80211_RADIOTAP_MCS`로 HT rate를 지정합니다. MCS flag는 short guard interval과 HT40 mode를 선택하고 `IEEE80211_RADIOTAP_DATA_RETRIES`는 지정 rate/MCS의 재시도 횟수를 정합니다.

`IEEE80211_RADIOTAP_VHT`는 자체 rate control이 없는 device의 VHT MCS와 stream 수를 지정합니다. flag로 short guard interval을 선택하고 bandwidth 값 1, 4, 11은 각각 40, 80, 160MHz channel width를 뜻합니다. injection code는 나머지 radiotap field를 건너뛸 수 있어 capture한 radiotap header를 그대로 replay하기 쉽습니다.

Injection radiotap 제어
Field효과
FLAGSFCS, WEP encryption, fragmentation
TX_FLAGSNOACK
RATElegacy 송신 rate
MCSHT rate, SGI, HT40
DATA_RETRIESrate/MCS 재시도 횟수
VHTVHT MCS, stream, SGI, 40/80/160MHz

송신 경로가 해석하는 field입니다.


Despite many radiotap parameters being currently defined, most only make sense
to appear on received packets.  The following information is parsed from the
radiotap headers and used to control injection:

 * IEEE80211_RADIOTAP_FLAGS

   =========================  ===========================================
   IEEE80211_RADIOTAP_F_FCS   FCS will be removed and recalculated
   IEEE80211_RADIOTAP_F_WEP   frame will be encrypted if key available
   IEEE80211_RADIOTAP_F_FRAG  frame will be fragmented if longer than the
                              current fragmentation threshold.
   =========================  ===========================================

 * IEEE80211_RADIOTAP_TX_FLAGS

   =============================  ========================================
   IEEE80211_RADIOTAP_F_TX_NOACK  frame should be sent without waiting for
                                  an ACK even if it is a unicast frame
   =============================  ========================================

 * IEEE80211_RADIOTAP_RATE

   legacy rate for the transmission (only for devices without own rate control)

 * IEEE80211_RADIOTAP_MCS

   HT rate for the transmission (only for devices without own rate control).
   Also some flags are parsed

   ============================  ========================
   IEEE80211_RADIOTAP_MCS_SGI    use short guard interval
   IEEE80211_RADIOTAP_MCS_BW_40  send in HT40 mode
   ============================  ========================

 * IEEE80211_RADIOTAP_DATA_RETRIES

   number of retries when either IEEE80211_RADIOTAP_RATE or
   IEEE80211_RADIOTAP_MCS was used

 * IEEE80211_RADIOTAP_VHT

   VHT mcs and number of streams used in the transmission (only for devices
   without own rate control). Also other fields are parsed

   flags field
        IEEE80211_RADIOTAP_VHT_FLAG_SGI: use short guard interval

   bandwidth field
        * 1: send using 40MHz channel width
        * 4: send using 80MHz channel width
        * 11: send using 160MHz channel width

The injection code can also skip all other currently defined radiotap fields
facilitating replay of captured radiotap headers directly.

Header 예제와 송신

72-106

예제 radiotap byte 배열은 version 0, header 길이 11, present bitmap, rate, TX power, antenna 값을 담습니다. 바로 뒤에는 frame control과 세 MAC 주소, sequence control로 구성된 IEEE 802.11 header가 오고 마지막에 payload가 이어집니다.

완성한 buffer는 monitor mode의 논리 mac80211 interface에 bind한 socket으로 `send()`합니다. 적절한 interface binding을 대신 처리하는 libpcap을 쓰면 `pcap_open_live`로 handle을 열고 `pcap_inject`로 buffer와 길이를 전달할 수 있습니다. 완전한 예제 애플리케이션은 문서 끝의 packetspammer link를 참조합니다.


Here is an example valid radiotap header defining some parameters::

        0x00, 0x00, // <-- radiotap version
        0x0b, 0x00, // <- radiotap header length
        0x04, 0x0c, 0x00, 0x00, // <-- bitmap
        0x6c, // <-- rate
        0x0c, //<-- tx power
        0x01 //<-- antenna

The ieee80211 header follows immediately afterwards, looking for example like
this::

        0x08, 0x01, 0x00, 0x00,
        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
        0x13, 0x22, 0x33, 0x44, 0x55, 0x66,
        0x13, 0x22, 0x33, 0x44, 0x55, 0x66,
        0x10, 0x86

Then lastly there is the payload.

After composing the packet contents, it is sent by send()-ing it to a logical
mac80211 interface that is in Monitor mode.  Libpcap can also be used,
(which is easier than doing the work to bind the socket to the right
interface), along the following lines:::

        ppcap = pcap_open_live(szInterfaceName, 800, 1, 20, szErrbuf);
        ...
        r = pcap_inject(ppcap, u8aSendBuffer, nLength);

You can also find a link to a complete inject application here:

https://wireless.wiki.kernel.org/en/users/Documentation/packetspammer

Andy Green <[email protected]>