Ndiswrapper Not Supported with Aircrack-Ng Tools

[hankovg]

Guys, I have got a weird problem.
Installed Kali Linux 2020.1 arm image on my Rasberry PI 4 and got my wifi working fine. Both the internal Wifi broadcom onboard driver and my Alfa AWUS036ACH Adapter (USB) with RTL8812AU driver worked flawless using the aircrack-ng tools.


Now here comes the strange thing. After a week or so, I have the following error below:

Ndiswrapper doesn't support monitor mode

when I put my wifi cards in monitor mode and start to use airodump-ng to capture my wifi traffic.



I have searched the web for possible solutions because I know that aircrack-ng tools do not support Ndiswrapper and it will never be supported. But the strange thing is that i did not install any ndiswrapper drivers in the first place , so I am really puzzled why I have suddenly this error. And the other strange thing is that both my wifi adapters (onboard and USB) are having the same problem.

I did some further investigation and I am getting it back to work if I first use kismet to monitor my wifi interface.


Quitting kismet leaves the wifi interface in monitor mode and then the aircrack-ng tools like airodump-ng are working fine for me.
But if I start fresh after reboot with the traditional commands

# airmon-ng check kill

# airmon-ng start wlan1

# airodump-ng --band abg wlan1

then airodump-ng throws the warning "Ndiswrapper doesn't support monitor mode" and exits.


Checked the code snippet below in aircrack-ng/lib/osdep/linux.c checking for ndiswrapper and I would like to understand what is actually tested to determine that the driver is using ndiswrapper. My suspicion is that this test is not full proof on the ARM distribution.

// Check if the driver is ndiswrapper */
static int is_ndiswrapper(const char  iface, const char  path)
{
int n, pid;
if (!path || !iface || strlen(iface) >= IFNAMSIZ)
{
return 0;
}
if ((pid = fork()) == 0)
{
close(0);
close(1);
close(2);
IGNORE_NZ(chdir("/"));
execl(path, "iwpriv", iface, "ndis_reset", NULL);
exit(1);
}

waitpid(pid, &n, 0);
return ((WIFEXITED(n) && WEXITSTATUS(n) == 0));
} 

Just wondering if somebody ran into a similar problem.
My kali linux version is:

[steev]

I can't reproduce this here; Although for me, the internal wifi card is wlan0 not wlan1.

I run airmon-ng start wlan0 which creates wlan0mon and then I run airodump-ng --band abg wlan0mon and everything shows as it is. What wireless devices are you using?

[hankovg]

Steev,

I have two wifi adapters, one onboard which is a broadcom (wlan0).

root@kali:~# lspci
00:00.0 PCI bridge: Broadcom Inc. and subsidiaries Device 2711 (rev 10)

and I have a USB Wifi Adapter AWUSACH036 (wlan1)

root@kali:~# lsusb
Bus 002 Device 002: ID 0bda:8812 Realtek Semiconductor Corp. RTL8812AU 802.11a/b/g/n/ac 2T2R DB WLAN Adapter

Both are behaving the same with the "ndiswrapper not supported" message if I try to capture the wifi traffic with airodump-ng.
As mentioned before, both adapters are working fine with kismet in monitor mode and keep working with airodump-ng when I stop kismet.

Only with a fresh start, this issue pops up...
I applied all the latest upgrades, but it did not help.
Checked dmesg but not errors or warnings that might indicate a problem.

It is a weird problem, because there is nothing wrong with the drivers because kismet works fine.
The ndiswrapper driver check in the aircrack-ng code might not be full proof in certain conditions.