11ax 抓包卡配置、wireshark抓包配置以及抓HE TB PPDU

准备工作

• Ubuntu/linux 系统， 64-bit OS
• Intel AX200 驱动的网卡
• 升级系统内核（此处是驱动要求内核必须在5.1+)，此处我用的是 5.1.21-050121-generic 内核安装包地址

cd /tmp/
wget -c https://kernel.ubuntu.com/~kernel-ppa/mainline/v5.1.21/linux-headers-5.1.21-050121_5.1.21-050121.201907280731_all.deb
wget -c https://kernel.ubuntu.com/~kernel-ppa/mainline/v5.1.21/linux-headers-5.1.21-050121-generic_5.1.21-050121.201907280731_amd64.deb
wget -c https://kernel.ubuntu.com/~kernel-ppa/mainline/v5.1.21/linux-image-unsigned-5.1.21-050121-generic_5.1.21-050121.201907280731_amd64.deb
wget -c https://kernel.ubuntu.com/~kernel-ppa/mainline/v5.1.21/linux-modules-5.1.21-050121-generic_5.1.21-050121.201907280731_amd64.deb
wget http://launchpadlibrarian.net/367327833/libssl1.1_1.1.0g-2ubuntu4_amd64.deb
wget http://ftp.cn.debian.org/debian/pool/main/c/cross-binutils/binutils-aarch64-linux-gnu_2.25-5_amd64.deb
sudo dpkg -i *.deb

安装驱动

• 驱动下载并安装

cd /tmp/
wget https://wireless.wiki.kernel.org/_media/en/users/drivers/iwlwifi/iwlwifi-cc-46.3cfab8da.0.tgz
tar -zxvf iwlwifi-cc-46.3cfab8da.0.tgz
cd iwlwifi-cc-46.3cfab8da.0
sudo cp -al /lib/firmware/ 

• 重启电脑

reboot

检查安装结果

➜  ~ lspci | grep Network
03:00.0 Network controller: Intel Corporation Wi-Fi 6 AX200 (rev 1a)
➜  ~ sudo lshw -class network
  *-network                 
       description: Ethernet interface
       product: Ethernet Connection I218-LM
       vendor: Intel Corporation
       physical id: 19
       bus info: pci@0000:00:19.0
       logical name: enp0s25
       version: 04
       serial: 28:d2:44:cf:cf:4b
       size: 100Mbit/s
       capacity: 1Gbit/s
       width: 32 bits
       clock: 33MHz
       capabilities: pm msi bus_master cap_list ethernet physical tp 10bt 10bt-fd 100bt 100bt-fd 1000bt-fd autonegotiation
       configuration: autonegotiation=on broadcast=yes driver=e1000e driverversion=3.2.6-k duplex=full firmware=0.6-3 ip=192.168.171.112 latency=0 link=yes multicast=yes port=twisted pair speed=100Mbit/s
       resources: irq:47 memory:f0600000-f061ffff memory:f063e000-f063efff ioport:3080(size=32)
  *-network
       description: Wireless interface
       product: Wi-Fi 6 AX200
       vendor: Intel Corporation
       physical id: 0
       bus info: pci@0000:03:00.0
       logical name: wlp3s0
       version: 1a
       serial: 08:5b:d6:94:4d:46
       width: 64 bits
       clock: 33MHz
       capabilities: pm msi pciexpress msix bus_master cap_list ethernet physical wireless
       configuration: broadcast=yes driver=iwlwifi driverversion=5.1.21-050121-generic firmware=46.3cfab8da.0 ip=192.168.202.96 latency=0 link=yes multicast=yes wireless=IEEE 802.11
       resources: irq:17 memory:f0400000-f0403fff
➜  ~ 
➜  ~ modinfo iwlwifi 
filename:       /lib/modules/5.1.21-050121-generic/kernel/drivers/net/wireless/intel/iwlwifi/iwlwifi.ko
license:        GPL
author:         Copyright(c) 2003- 2015 Intel Corporation <linuxwifi@intel.com>
description:    Intel(R) Wireless WiFi driver for Linux
firmware:       iwlwifi-100-5.ucode
firmware:       iwlwifi-1000-5.ucode
firmware:       iwlwifi-135-6.ucode
firmware:       iwlwifi-105-6.ucode
firmware:       iwlwifi-2030-6.ucode
firmware:       iwlwifi-2000-6.ucode
firmware:       iwlwifi-5150-2.ucode
...
depends:        cfg80211
retpoline:      Y
intree:         Y
name:           iwlwifi
vermagic:       5.1.21-050121-generic SMP mod_unload 
signat:         PKCS#7
signer:         
sig_key:        
sig_hashalgo:   md4
parm:           swcrypto:using crypto in software (default 0 [hardware]) (int)
parm:           11n_disable:disable 11n functionality, bitmap: 1: full, 2: disable agg TX, 4: disable agg RX, 8 enable agg TX (uint)

如果发现vermagic: 5.1.21-050121-generic SMP mod_unload, 需要

sudo modprobe iwlwifi

最后，查看网卡

➜  ~ iw dev
phy#0
	Unnamed/non-netdev interface
		wdev 0x2
		addr 08:5b:d6:94:4d:47
		type P2P-device
		txpower 0.00 dBm
	Interface wlp3s0
		ifindex 3
		wdev 0x1
		addr 08:5b:d6:94:4d:46
		ssid esp-office-2.4G
		type managed
		channel 8 (2447 MHz), width: 20 MHz, center1: 2447 MHz
		txpower 22.00 dBm
➜  ~

更新wireshark（建议更新）

sudo add-apt-repository ppa:wireshark-dev/stable
sudo apt-get update
sudo qpt-get install wireshark --upgrade

抓包配置

• 获取PCI code

# 获取无线网卡名称，其中我的是 wlp3s0
➜  ~ iw dev
phy#0
	Unnamed/non-netdev interface
		wdev 0x6
		addr 08:5b:d6:94:4d:47
		type P2P-device
		txpower 0.00 dBm
	Interface wlp3s0
		ifindex 3
		wdev 0x1
		addr 08:5b:d6:94:4d:46
		ssid esp-office-2.4G
		type managed
		channel 8 (2447 MHz), width: 20 MHz, center1: 2447 MHz
		txpower 22.00 dBm

# 根据无线网卡名获取pci code, 将 wlp3s0 替换成你本地的iface名称
➜  ~ sudo lshw -class network -businfo | grep wlp3s0 | awk '{print $1}' | awk -F @ '{print $2}'
0000:03:00.0 
➜  ~ pci_code=$(sudo lshw -class network -businfo | grep wlp3s0 | awk '{print $1}' | awk -F @ '{print $2}')
➜  ~ echo $pci_code
0000:03:00.0

• 下列命令不会永久生效，需要每次重启电脑之后再运行一次才会生效抓包配置

sudo chmod a+rx /sys/kernel/debug
sudo chmod a+rx /sys/kernel/debug/iwlwifi
sudo chmod a+rx /sys/kernel/debug/iwlwifi/$pci_code
sudo chmod a+rx /sys/kernel/debug/iwlwifi/$pci_code/iwlmvm
sudo chmod a+rwx /sys/kernel/debug/iwlwifi/$pci_code/iwlmvm/he_sniffer_params

如何抓不同AID的 HE TB PPDU

echo [AID] [BSSID] > /sys/kernel/debug/iwlwifi/$pci_code/iwlmvm/he_sniffer_params

• 其中AID设备与AP进行连接后的AID，BSSID为AP的MAC地址
• 除此之外，注意每新建立一次连接，对应的AID都可能会相应的变化，此时需要重新配置以下命令
• 目前一张网卡只能抓一个设备（也就是一个AID）的 HE TB，如果需要看多个设备，需要轮流切换或者准备多个网卡
• 举例

echo 8 58:41:20:7f:6f:f1 > /sys/kernel/debug/iwlwifi/$pci_code/iwlmvm/he_sniffer_params