airpcap-nl
----------
airpcap-nl is an implementation of core parts of the Airpcap Windows library
for nl80211 drivers in Linux. It provides a convenience abstraction for
creating and using monitor interfaces for wireless packet captures on
802.11abgn devices.
Recommended Adapters
====================
Any adapter with good mac80211/cfg80211 support will work with this library.
No wext-only drivers will work! You should convert your application to use
lorcon for that purpose.
The adapters I have had most success with have chipsets supported by
ath9k(_htc) and iwlagn. I have had limited success with rt2x00 adapters,
but that is mostly due to recent adapters being relatively unsupported.
Implementation status
=====================
Supported calls (with some caveats):
- AirpcapGetVersion
- AirpcapGetLastError
- AirpcapGetDeviceList
- AirpcapFreeDeviceList
- AirpcapOpen
- AirpcapClose
- AirpcapGetDeviceCapabilities
- AirpcapGetLinkType
- Always returns AIRPCAP_LT_802_11_PLUS_RADIO.
- AirpcapGetDeviceMacFlags
- Always returns AIRPCAP_MF_MONITOR_MODE_ON set,
AIRPCAP_MF_ACK_FRAMES_ON cleared.
- AirpcapGetFcsPresence
- Always returns TRUE.
- AirpcapSetFcsValidation
- Does not support AIRPCAP_VT_ACCEPT_CORRUPT_FRAMES.
- AirpcapGetFcsValidation
- AirpcapGetDecryptionState
- Always returns AIRPCAP_DECRYPTION_OFF.
- AirpcapSetDeviceChannel
- AirpcapGetDeviceChannel
- AirpcapSetDeviceChannelEx
- AirpcapGetDeviceChannelEx
- AirpcapGetDeviceSupportedChannels
- AirpcapConvertFrequencyToChannel
- AirpcapConvertChannelToFrequency
- AirpcapGetMacAddress
- AirpcapSetTxPower
- AirpcapGetTxPower
Stubbed calls:
- AirpcapSetLinkType
- mac80211 does not support anything but AIRPCAP_LT_802_11_PLUS_RADIO
- AirpcapSetDeviceMacFlags
- mac80211 does not support frame acknowledgement in monitor mode AFAIK.
It may be possible to support this with an additional managed interface.
- AirpcapSetFcsPresence
- mac80211 cannot configure the driver either way. Most drivers do always
return frames with FCS.
- AirpcapSetDeviceKeys
- AirpcapGetDeviceKeys
- AirpcapSetDriverKeys
- AirpcapGetDriverKeys
- AirpcapSetDecryptionState
- We do not support hardware decryption.
- AirpcapSetKernelBuffer
- AirpcapGetKernelBufferSize
- AirpcapSetMinToCopy
- AirpcapGetReadEvent
- These calls don't make sense outside of the Airpcap driver model.
- AirpcapSetFilter
- AirpcapRead
- AirpcapGetStats
- These calls are all available in libpcap. Without having access to all
capture handles open for this device, there's no way to implement
these. Equivalent:
- AirpcapSetFilter: pcap_compile/pcap_setfilter
- AirpcapRead: pcap_next, pcap_next_ex
- AirpcapGetStats: pcap_stats
- AirpcapGetLedsNumber
- AirpcapTurnLedOn
- AirpcapTurnLedOff
- We don't have any access to the LEDs in a consistent way, AFAIK. Some
mac80211 drivers may support toggling the LEDs, but it's too much hassle
for a capture interface. We simply return 0 for AirpcapGetLedsNumber.
Stubbed, but will eventually be supported:
- AirpcapSetMacAddress
- Easily implemented.
- AirpcapWrite
- For now, this can be replaced in application code via pcap_inject.
Stubbed, but may eventually get supported:
- AirpcapGetDeviceTimestamp
- This would be incredibly useful, but I have no idea how to get the
current adapter TSFT from mac80211. Many drivers support it and it is
used for radiotap, but there is no exposure in nl80211.
- AirpcapStoreCurConfigAsAdapterDefault
- This could be stored on the filesystem and restored on AirpcapOpen.