OpenWrt Forum Archive

Topic: Error: That device doesn't support monitor mode (TP-Link mr3020)

The content of this topic has been archived on 2 May 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

I cross compiled this code for TP-Link mr 3020 with chaos calmer.

#include <stdio.h>
#include <pcap.h>               // libpcap 1.5.3 is installed on OpenWrt
#include <stdlib.h>
#include <unistd.h>      

int main(void)
{
    pcap_t *handle; 
    int status=0;
    int header_type;
    char errbuf[PCAP_ERRBUF_SIZE];
    /* openwrt && linux */
    char *dev=(char *)"wlan0";
   
    handle=pcap_create(dev,errbuf); 

    if (handle == NULL)  {
        fprintf(stderr, "Couldn't open device %s: %s\n", dev, errbuf);
        return 0;
    }

       if(pcap_set_rfmon(handle,1)!=0) {
        fprintf(stderr, "Device %s couldn't be opened in monitor mode\n", dev);
        return 0;
    } else {
        printf("Device %s has been opened in monitor mode\n", dev);
    }

    pcap_set_promisc(handle,0);   
    pcap_set_snaplen(handle,65535);   
    status=pcap_activate(handle);        // This fails.

    if(status!=0) {
        pcap_perror(handle,(char*)"pcap error: ");
        return 0;
    }

    header_type=pcap_datalink(handle); 
    if(header_type!=DLT_IEEE802_11_RADIO) {
        printf("Error: incorrect header type - %d\n",header_type);
        return 0;
    }

}

Every  time I run the installed binary on the router I get this error:

Device wlan0 has been opened in monitor mode
pcap error: : That device doesn't support monitor mode

`pcap_activate(handle);` function fails to activate the handle I have no idea why? Here is the make file: 

include $(TOPDIR)/rules.mk

PKG_NAME:=opensniff
PKG_VERSION:=1.0.1
PKG_BUILD_DEPENDS:=libpcap

include $(INCLUDE_DIR)/package.mk
include $(INCLUDE_DIR)/kernel.mk

PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)

define Package/opensniff
    SECTION:=utils
    CATEGORY:=Utilities
    DEPENDS:=+libpcap
    TITLE:=Test raditap header fields.
endef

define Package/$(PKG_NAME)/description
    Test the network card for the radiotap fields it supports.
endef

define Build/Prepare
    mkdir -p $(PKG_BUILD_DIR)
    $(CP) ./src/* $(PKG_BUILD_DIR)/
endef

define Build/Compile
    $(MAKE) -C $(PKG_BUILD_DIR) $(TARGET_CONFIGURE_OPTS)
endef

define Package/$(PKG_NAME)/install
    $(INSTALL_DIR) $(1)/bin
    $(INSTALL_BIN) $(PKG_BUILD_DIR)/$(PKG_NAME) $(1)/bin
endef

$(eval $(call BuildPackage,$(PKG_NAME)))

How to fix this?

I'm assuming you have an AP running on wlan0.  You can't change the mode of an interface while it is up.

When I'm going to do some radiotap monitoring, I create a mon0 in /etc/config/wireless and let UCI start it up. 

config wifi-iface
  option device 'radio0'
  option mode 'monitor'
  option ifname 'mon0'

There's no real harm in leaving a monitor interface up unused.

(Last edited by mk24 on 12 Jun 2017, 22:38)

mk24 wrote:

I'm assuming you have an AP running on wlan0.  You can't change the mode of an interface while it is up.

When I'm going to do some radiotap monitoring, I create a mon0 in /etc/config/wireless and let UCI start it up. 

config wifi-iface
  option device 'radio0'
  option mode 'monitor'
  option ifname 'mon0'

There's no real harm in leaving a monitor interface up unused.

OK. Do you use libpcap or some other tool/library for monitoring?

(Last edited by haccks on 13 Jun 2017, 08:50)

Did you know that you do not have to repeat the complete previous posting, since it can easily be viewed above yours?

Hint: Instead of blindly hitting "Quote" and keeping a complete copy of the previous posting, you can simply click "Post reply".

Man! It looks like my post offended you.

You've also been starting new threads about the same problem, which is not polite.  It clutters the forum and makes it difficult for people to follow what you have been doing.  When you try or find something else (even if it did not work), update your original thread.

As far as running monitors on a router, I have not gone beyond simply using airodump-ng to take a quick look.

(Last edited by mk24 on 13 Jun 2017, 13:53)

haccks wrote:

Man! It looks like my post offended you.

Don't take it personally.
Please think about all the long-term users that invest their spare time, trying to help, giving advice, pointing in the right direction, and not getting paid for their efforts. Seeing each day copy of copy of copy of things that have already been written one, two, three postings above does neither speed up reading nor does it raise motivation.

Fullquotes may be OK in mailing list; in forums like this one however, they are mostly unnecessary and rather a nuisance.

From your reply I see that you learned this lesson now, and you will certainly remember this when replying in the future.

To put your mind at ease: You are not the first and only one who makes mistakes when quoting. It has been like this since more than 20 years, since the beginning of the Internet. smile

Friends again?-)

The discussion might have continued from here.