kninja
2016-04-17, 01:38
I am having a weird problem with my new AWUS051NH, its v2 with an RT3572 chipset. After spending all day trying to figure out why the device appeared to be entereing monitor mode but not actually capturing anything except broadcast traffic, I finally stumbled across mention of a regression in the rt2x00usb driver which broke monitor mode (http://www.spinics.net/lists/linux-wireless/msg146019.html if anyone is interested). I've since run a full system update and am now running kernel vmlinuz-4.4.0-kali1-amd64, which solved my monitor mode problem, and I'm now able to capture traffic from other stations.
The capturing seems to be working fine now, I can even capture WPA handshakes if one happens to occur naturally, but when I try to execute an injection attack using aireplay, I get the following error:
21:07:07 Waiting for beacon frame (BSSID: XX:XX:XX:XX:XX:XX) on channel 11
read failed: Network is down
wi_read(): Network is down
write failed: No such device or address
wi_write(): No such device or address
64 directed DeAuth. STMAC: [YY:YY:YY:YY:YY] [ 0| 0 ACKs]
I thought maybe the driver was crashing, but If i watch the messages file when this happens, it appears as if the device is momentarily dropping off the USB bus then reconnecting:
Apr 16 21:07:07 kernel: [ 2163.333422] device wlan0mon entered promiscuous mode
Apr 16 21:07:08 kernel: [ 2163.590278] usb 3-3: USB disconnect, device number 9
Apr 16 21:07:08 NetworkManager[795]: <info> [1460804828.3101] devices removed (path: /sys/devices/pci0000:00/0000:00:14.0/usb3/3-3/3-3:1.0/net/wlan0mon, iface: wlan0mon)
Apr 16 21:07:08 NetworkManager[795]: <info> [1460804828.3282] radio killswitch /sys/devices/pci0000:00/0000:00:14.0/usb3/3-3/3-3:1.0/ieee80211/phy3/rfkill5 disappeared
Apr 16 21:07:08 kernel: [ 2164.023643] usb 3-3: new high-speed USB device number 10 using xhci_hcd
Apr 16 21:07:08 kernel: [ 2164.223750] usb 3-3: New USB device found, idVendor=148f, idProduct=3572
Apr 16 21:07:08 kernel: [ 2164.223754] usb 3-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3
Apr 16 21:07:08 kernel: [ 2164.223755] usb 3-3: Product: 802.11 n WLAN
Apr 16 21:07:08 kernel: [ 2164.223756] usb 3-3: Manufacturer: Ralink
Apr 16 21:07:08 kernel: [ 2164.223757] usb 3-3: SerialNumber: 1.0
Apr 16 21:07:08 kernel: [ 2164.391864] usb 3-3: reset high-speed USB device number 10 using xhci_hcd
Apr 16 21:07:09 kernel: [ 2164.585162] ieee80211 phy4: rt2x00_set_rt: Info - RT chipset 3572, rev 0223 detected
Apr 16 21:07:09 kernel: [ 2164.595385] ieee80211 phy4: rt2x00_set_rf: Info - RF chipset 0009 detected
Apr 16 21:07:09 NetworkManager[795]: <info> [1460804829.1601] (wlan0): using nl80211 for WiFi device control
Apr 16 21:07:09 NetworkManager[795]: <info> [1460804829.1601] device (wlan0): driver supports Access Point (AP) mode
Apr 16 21:07:09 NetworkManager[795]: <info> [1460804829.1609] manager: (wlan0): new 802.11 WiFi device (/org/freedesktop/NetworkManager/Devices/6)
Apr 16 21:07:10 NetworkManager[795]: <info> [1460804830.1729] rfkill6: found WiFi radio killswitch (at /sys/devices/pci0000:00/0000:00:14.0/usb3/3-3/3-3:1.0/ieee80211/phy4/rfkill6) (driver rt2800usb)
Apr 16 21:07:10 NetworkManager[795]: <info> [1460804830.1778] devices added (path: /sys/devices/pci0000:00/0000:00:14.0/usb3/3-3/3-3:1.0/net/wlan0, iface: wlan0)
If I run airmon-ng again after this I can see that the monitor mode interface is gone, wlan0 is back but the phy number has incremented by 1.
So a couple of questions: anyone else seen this behavior, and does anyone have any suggestions as to how to fix/workaround it?
Thanks
The capturing seems to be working fine now, I can even capture WPA handshakes if one happens to occur naturally, but when I try to execute an injection attack using aireplay, I get the following error:
21:07:07 Waiting for beacon frame (BSSID: XX:XX:XX:XX:XX:XX) on channel 11
read failed: Network is down
wi_read(): Network is down
write failed: No such device or address
wi_write(): No such device or address
64 directed DeAuth. STMAC: [YY:YY:YY:YY:YY] [ 0| 0 ACKs]
I thought maybe the driver was crashing, but If i watch the messages file when this happens, it appears as if the device is momentarily dropping off the USB bus then reconnecting:
Apr 16 21:07:07 kernel: [ 2163.333422] device wlan0mon entered promiscuous mode
Apr 16 21:07:08 kernel: [ 2163.590278] usb 3-3: USB disconnect, device number 9
Apr 16 21:07:08 NetworkManager[795]: <info> [1460804828.3101] devices removed (path: /sys/devices/pci0000:00/0000:00:14.0/usb3/3-3/3-3:1.0/net/wlan0mon, iface: wlan0mon)
Apr 16 21:07:08 NetworkManager[795]: <info> [1460804828.3282] radio killswitch /sys/devices/pci0000:00/0000:00:14.0/usb3/3-3/3-3:1.0/ieee80211/phy3/rfkill5 disappeared
Apr 16 21:07:08 kernel: [ 2164.023643] usb 3-3: new high-speed USB device number 10 using xhci_hcd
Apr 16 21:07:08 kernel: [ 2164.223750] usb 3-3: New USB device found, idVendor=148f, idProduct=3572
Apr 16 21:07:08 kernel: [ 2164.223754] usb 3-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3
Apr 16 21:07:08 kernel: [ 2164.223755] usb 3-3: Product: 802.11 n WLAN
Apr 16 21:07:08 kernel: [ 2164.223756] usb 3-3: Manufacturer: Ralink
Apr 16 21:07:08 kernel: [ 2164.223757] usb 3-3: SerialNumber: 1.0
Apr 16 21:07:08 kernel: [ 2164.391864] usb 3-3: reset high-speed USB device number 10 using xhci_hcd
Apr 16 21:07:09 kernel: [ 2164.585162] ieee80211 phy4: rt2x00_set_rt: Info - RT chipset 3572, rev 0223 detected
Apr 16 21:07:09 kernel: [ 2164.595385] ieee80211 phy4: rt2x00_set_rf: Info - RF chipset 0009 detected
Apr 16 21:07:09 NetworkManager[795]: <info> [1460804829.1601] (wlan0): using nl80211 for WiFi device control
Apr 16 21:07:09 NetworkManager[795]: <info> [1460804829.1601] device (wlan0): driver supports Access Point (AP) mode
Apr 16 21:07:09 NetworkManager[795]: <info> [1460804829.1609] manager: (wlan0): new 802.11 WiFi device (/org/freedesktop/NetworkManager/Devices/6)
Apr 16 21:07:10 NetworkManager[795]: <info> [1460804830.1729] rfkill6: found WiFi radio killswitch (at /sys/devices/pci0000:00/0000:00:14.0/usb3/3-3/3-3:1.0/ieee80211/phy4/rfkill6) (driver rt2800usb)
Apr 16 21:07:10 NetworkManager[795]: <info> [1460804830.1778] devices added (path: /sys/devices/pci0000:00/0000:00:14.0/usb3/3-3/3-3:1.0/net/wlan0, iface: wlan0)
If I run airmon-ng again after this I can see that the monitor mode interface is gone, wlan0 is back but the phy number has incremented by 1.
So a couple of questions: anyone else seen this behavior, and does anyone have any suggestions as to how to fix/workaround it?
Thanks