1How to use packet injection with mac80211
2=========================================
3
4mac80211 now allows arbitrary packets to be injected down any Monitor Mode
5interface from userland.  The packet you inject needs to be composed in the
6following format:
7
8 [ radiotap header  ]
9 [ ieee80211 header ]
10 [ payload ]
11
12The radiotap format is discussed in
13./Documentation/networking/radiotap-headers.txt.
14
15Despite many radiotap parameters being currently defined, most only make sense
16to appear on received packets.  The following information is parsed from the
17radiotap headers and used to control injection:
18
19 * IEEE80211_RADIOTAP_FLAGS
20
21   IEEE80211_RADIOTAP_F_FCS: FCS will be removed and recalculated
22   IEEE80211_RADIOTAP_F_WEP: frame will be encrypted if key available
23   IEEE80211_RADIOTAP_F_FRAG: frame will be fragmented if longer than the
24			      current fragmentation threshold.
25
26 * IEEE80211_RADIOTAP_TX_FLAGS
27
28   IEEE80211_RADIOTAP_F_TX_NOACK: frame should be sent without waiting for
29				  an ACK even if it is a unicast frame
30
31 * IEEE80211_RADIOTAP_RATE
32
33   legacy rate for the transmission (only for devices without own rate control)
34
35 * IEEE80211_RADIOTAP_MCS
36
37   HT rate for the transmission (only for devices without own rate control).
38   Also some flags are parsed
39
40   IEEE80211_RADIOTAP_MCS_SGI: use short guard interval
41   IEEE80211_RADIOTAP_MCS_BW_40: send in HT40 mode
42
43 * IEEE80211_RADIOTAP_DATA_RETRIES
44
45   number of retries when either IEEE80211_RADIOTAP_RATE or
46   IEEE80211_RADIOTAP_MCS was used
47
48 * IEEE80211_RADIOTAP_VHT
49
50   VHT mcs and number of streams used in the transmission (only for devices
51   without own rate control). Also other fields are parsed
52
53   flags field
54   IEEE80211_RADIOTAP_VHT_FLAG_SGI: use short guard interval
55
56   bandwidth field
57   1: send using 40MHz channel width
58   4: send using 80MHz channel width
59   11: send using 160MHz channel width
60
61The injection code can also skip all other currently defined radiotap fields
62facilitating replay of captured radiotap headers directly.
63
64Here is an example valid radiotap header defining some parameters
65
66	0x00, 0x00, // <-- radiotap version
67	0x0b, 0x00, // <- radiotap header length
68	0x04, 0x0c, 0x00, 0x00, // <-- bitmap
69	0x6c, // <-- rate
70	0x0c, //<-- tx power
71	0x01 //<-- antenna
72
73The ieee80211 header follows immediately afterwards, looking for example like
74this:
75
76	0x08, 0x01, 0x00, 0x00,
77	0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
78	0x13, 0x22, 0x33, 0x44, 0x55, 0x66,
79	0x13, 0x22, 0x33, 0x44, 0x55, 0x66,
80	0x10, 0x86
81
82Then lastly there is the payload.
83
84After composing the packet contents, it is sent by send()-ing it to a logical
85mac80211 interface that is in Monitor mode.  Libpcap can also be used,
86(which is easier than doing the work to bind the socket to the right
87interface), along the following lines:
88
89	ppcap = pcap_open_live(szInterfaceName, 800, 1, 20, szErrbuf);
90...
91	r = pcap_inject(ppcap, u8aSendBuffer, nLength);
92
93You can also find a link to a complete inject application here:
94
95http://wireless.kernel.org/en/users/Documentation/packetspammer
96
97Andy Green <andy@warmcat.com>
98