Monitor mode does not capture ack packets

[greg2891]

Hi I am using this driver with TPlink T9UH(EU) v2 and noticed that in monitor mode with WireShark I cannot capture ACKs packets i.e when using display filter wlan.fc.type_subtype == 0x001d nothing is captured . I did try capture packets with inSSIDer software for win10 and same adapter and Acknolegment packets are captured . Please can you advise ?

[morrownr]

Hi @greg2891

Let me put this issue on my to-do list. I'll try to test as soon as I am able.

To anyone else that may read this. I am very busy currently with work on other repos at this site so if anyone is able to test this issue and provide information, please jump in.

Nick

[greg2891]

Hi @morrownr Thanks for prompt response and offer to help resolve this issue . Thanks Greg

[greg2891]

Hello Just quick add on - I have bought this adapter https://www.amazon.co.uk/gp/product/B086L86NG1/ref=ppx_yo_dt_b_asin_title_o00_s00?ie=UTF8&th=1 as it was stated that it has MTK7612 chipset but in reality it has Realtek . I have installed driver from here : https://github.com/cilynx/rtl88x2BU_WiFi_linux_v5.3.1_27678.20180430_COEX20180427-5959 and noticed simmilar problem - cannot capture ACKs packets . Not sure now if this is Realtek driver issue ??? or my setup ??? but as mentioned above I can capture ACKs packets with inSSIDer on Win10

[morrownr]

Hello Just quick add on - I have bought this adapter https://www.amazon.co.uk/gp/product/B086L86NG1/ref=ppx_yo_dt_b_asin_title_o00_s00?ie=UTF8&th=1 as it was stated that it has MTK7612 chipset but in reality it has Realtek .

Greg, there is a lot of misinformation out there. You may have already seen this repo but if you haven't:

https://github.com/morrownr/USB-WiFi

I have several usb wifi adapters and I will be glad to help you sort through the mess to get something that works well if you want.

I have installed driver from here : https://github.com/cilynx/rtl88x2BU_WiFi_linux_v5.3.1_27678.20180430_COEX20180427-5959 and noticed simmilar problem - cannot capture ACKs packets .

You really don't want an adapter based on the 8812bu chipset if you are doing monitor mode work. I have a repo for this chipset:

https://github.com/morrownr/88x2bu

... and I am in the process of bringing a new version online. Testing is going on right now and I would invite you but I made the decision to not even activate monitor mode in this new driver. There are 2 and only Realtek drivers that are reasonably good at monitor mode:

https://github.com/morrownr/8812au-20210629 https://github.com/morrownr/8821au-20210708

With that said, the overall best results from usb wifi adapters in monitor mode come from Mediatek based adapters. My two favorites are:

ALFA AWUS036ACHM - mt7610u - https://www.varia-store.com/en/produkt/102561-awus036achm-802-11ac-wifi-range-boost-usb-adapter.html

ALFA AWUS036ACM - mt7612u - https://store.rokland.com/collections/wi-fi-usb-adapters/products/alfa-awus036acm-802-11ac-dual-band-2-4-5-ghz-wifi-usb-adapter

I realize these adapters cost a little more than many adapters but the quality is first rate. The ACHM (top) has the longest range of any dual band adapter I've ever used.

Not sure now if this is Realtek driver issue ???

Likely a driver issue. I really encourage people using monitor mode to stay away from the rtl8812bu, rtl8814au and rtl8811cu chipsets. The chipsets I recommend are:

mt7612u mt7610u rtl8812au rtl8811au

The drivers for the mt76 chipsets are in-kernel and are standards (mac80211) compliant and work with monitor mode in a textbook manner. The rtl drivers are out of kernel and are not standards compliant. The two drivers I maintain for the Realtek chipsets above are actually pretty good... for Realtek drivers.

FYI: I was able to rearrange my lab to activate my 8814au based adapter this morning. I still haven't had time to test but hope to do so within a few days if you are still interested.

Regards

Nick

[greg2891]

Hi Nick Thanks a lot for above information. i have bought this adapter after reading your repo at : https://github.com/morrownr/USB-WiFi - I thought i can trust Amazon description but as you said there is a lot of misinformation :( .

I dont mind spend a little more as long as the adapter will provide functionality I need for my project but it is hard here in UK to find adapter from your list for which you do not need to wait long time.

I have looked through the links provided by you above and will get(if current adaptors wont be able to capture all packets) probably ALFA AWUS036ACHM as not sure if I can easly get something from US.

I have checked if I could get top adater from your list ALFA AWUS036ACM in UK but it looks like it is not possible at the moment .

Thanks for your support and hope we can get working monitor mode on TPlink t9UH/and or Terow as I have now 2 adapters which I cant really use for what I want .

I understand that this issue requirie lot of time from you to test/fix this problem and I am really greatful for your help. If there is something I can do /test to help with this issue please just let me know (I am not SW enginner(actually I am HW engineer ) so not helpful in driver side but can perform some tests if necessery .

Summarise :

• I will wait for your response on 8814au testing
• If above is not fixable or need a lot of time Ill get one of the suggested by you adapters

[morrownr]

Hi Greg

Hi Nick Thanks a lot for above information. i have bought this adapter after reading your repo at : https://github.com/morrownr/USB-WiFi - I thought i can trust Amazon description but as you said there is a lot of misinformation :( .

I hate that this happened. I have put up a warning giving the specific details so maybe it will help others. One digit off and we get the wrong chipset! There is a lot of really bad information out there...and that is one of the reasons that I started the repo with the links to adapters that work well with Linux. There was just no good source for Linux users!

I have looked through the links provided by you above and will get(if current adaptors wont be able to capture all packets) probably ALFA AWUS036ACHM as not sure if I can easly get something from US.

I noticed that you are in the UK so the link I send was to a German retailer hoping that would work. Here it is again:

https://www.varia-store.com/en/produkt/102561-awus036achm-802-11ac-wifi-range-boost-usb-adapter.html

Varia appears to be an ALFA Network authorized dealer that carries the full line. The ACHM, ACM and more. I have numerous adapters to include an ACHM, ACM, ACH, ACS and various adapters from other makers with various chipsets.

The ACHM (mt7610u) and ACH (rtl8812au) have exceptional range. Here is a comparison I did earlier this year:

https://github.com/morrownr/USB-WiFi/blob/main/Performance_Comparison.md

Thanks for your support and hope we can get working monitor mode on TPlink t9UH/and or Terow as I have now 2 adapters which I cant really use for what I want .

I have my 8814au based adapter setup on a test system and I have a 8812bu adapter on the same system. I also have Wireshark installed. What I don't have is much experience with Wireshark. I usually test monitor mode with Aircrack-ng. I'm a little under the weather right now so am slowed down but if you could make me a step by step checklist, maybe like the one for installation in the README here, I could follow it so that I am getting exactly what you want. I could test numerous adapters until you see what you want to see. Fair enough?

Regards

Nick

P.S. I spent a lot of time in the UK earlier in my life. I have many fond memories of it.

[morrownr]

FYI

[greg2891]

Hi Nick

https://www.varia-store.com/en/produkt/102561-awus036achm-802-11ac-wifi-range-boost-usb-adapter.html Varia appears to be an ALFA Network authorized dealer that carries the full line. The ACHM, ACM and more. I have numerous adapters to include an ACHM, ACM, ACH, ACS and various adapters from other makers with various chipsets.

The ACHM (mt7610u) and ACH (rtl8812au) have exceptional range. Here is a comparison I did earlier this year:

https://github.com/morrownr/USB-WiFi/blob/main/Performance_Comparison.md

I think I will get one of them anyway as by having in kernel driver ,in most cases, it will be plug and play even if I upgrade my system.

I have my 8814au based adapter setup on a test system and I have a 8812bu adapter on the same system. I also have Wireshark installed. What I don't have is much experience with Wireshark. I usually test monitor mode with Aircrack-ng. I'm a little under the weather right now so am slowed down but if you could make me a step by step checklist, maybe like the one for installation in the README here, I could follow it so that I am getting exactly what you want. I could test numerous adapters until you see what you want to see. Fair enough?

**To be honest I do not really think you need any instruction on this as you can use any tool (you preffer) to capture packets. I did test using wireshark and tcpdump and both shows same problem. Steps to reproduce issue in wireshark are .

1. Place wifi adapter in monitor mode i.e freq 2.4GHz channel 1(I did not test 5GHz).
2. open wireshark - probably need to be opened with root privilege to access network interfaces
3. From list of interfaces pick one of interest and double click on it - wireshark will start and you should see captured packets displayed.
4. In filter ccommand line type filter name wlan.fc.type_subtype == 0x001d or wlan.fc.type_subtype == 29 (same fiter just in decimal) --> hit enter and check if any acknowledgement packets are displayed - in my case nothing is displayed and I have used other adapter in same setup and seen these packets captured.
5. In case you use differen tool to capture packets - when capturing packets with different tool save them to file i.e name.cap or name.pcap --> once capturing done open file with wireshark apply same filter as in 4 and check if any Acks packets captured .

Hope above is clear but if not then please let me know so I`ll try prepare some pictured instruction.**

P.S. I spent a lot of time in the UK earlier in my life. I have many fond memories of it.

Originally I am not from UK but living here for over 15 years now :)

Thanks Greg

[greg2891]

P.S - ordered ALFA AWUS036ACM from the shop link provided by you : ) hope it will do the job :)

[morrownr]

**To be honest I do not really think you need any instruction on this as you can use any tool (you preffer) to capture packets.

What I seek to avoid is misunderstanding. I like to duplicate what you are doing so that I see what you are seeing.

Steps to reproduce issue in wireshark are .

1. Place wifi adapter in monitor mode i.e freq 2.4GHz channel 1(I did not test 5GHz).

I currently have 3 usb wifi adapter connected to the test system. I will test all 3 while I am at it. I will place them in monitor mode one at a time and only have one in monitor at a time. I set channel 1 for testing.

2. open wireshark - probably need to be opened with root privilege to access network interfaces

$ sudo wireshark

3. From list of interfaces pick one of interest and double click on it - wireshark will start and you should see captured packets displayed.

I selected an interface and clicked on Start... and it did start.

4. In filter ccommand line type filter name wlan.fc.type_subtype == 0x001d or wlan.fc.type_subtype == 29 (same fiter just in decimal) --> hit enter and check if any acknowledgement packets are displayed - in my case nothing is displayed and I have used other adapter in same setup and seen these packets captured.

I used display filter wlan.fc.type_subtype == 29

Results seen for the 3 separate tests:

Adapter: Generic rtl8814au based Chipset: rtl8814au Driver: https://github.com/morrownr/8814au Result: No packets displayed (failure)

Adapter: ALFA AWUS036ACM Chipset: mt7612u Driver: https://github.com/torvalds/linux/tree/master/drivers/net/wireless/mediatek/mt76 Result: Many packets displayed (success)

Adapter: ALFA AWUS036ACS Chipset: rtl8811au Driver: https://github.com/morrownr/8821au-20210708 Result: Many packets displayed (success)

I also have the following adapters that I can test if you wish:

ALFA AWUS036ACHM (mt7610u) Driver: https://github.com/torvalds/linux/tree/master/drivers/net/wireless/mediatek/mt76

ALFA AWUS036ACH (rtl8812au) Driver: https://github.com/morrownr/8812au-20210629

My experience is that users of monitor mode should give priority to the following usb wifi chipsets: (adapters based on all of the below are available for sale as new products currently)

mt7612u (dual band) mt7610u (dual band) rtl8812au (dual band) rtl8811au (dual band) rt5572 (dual band) rt3572 (dual band) rt5372 rt5370 ar9271 rt3070

I advise monitor mode users to avoid adapters based on the following chipsets:

rtl8811cu (8821cu) rtl8812bu (88x2bu) rtl8814au (8814au)

With that said, I see you have an ACM on the way. It should serve you well. In the mean time, I am currently testing a new driver for the 8812bu chipset. The repo is currently private with 4 individuals helping test. I have no intention of supporting monitor mode with that driver but, if you are interested in having access to the repo, I will provide instructions for you to turn on monitor mode for testing. Let me know if you are interested. Regarding the 8814au based adapter. I can start trying to chase the bug if you want but this 8814au driver is old and fragile and I can't gurantee anything. We need a new, modernized version of the source from Realtek but I am not holding my breathe.

Regards

[greg2891]

Hi Nick Wow - Thanks for very detailied response and your time for all these tests - I see you had no issues to reproduce my setup :)

Results seen for the 3 separate tests:

Adapter: Generic rtl8814au based Chipset: rtl8814au Driver: https://github.com/morrownr/8814au Result: No packets displayed (failure)

Good it shows same issue as what I see :)

Adapter: ALFA AWUS036ACM Chipset: mt7612u Driver: https://github.com/torvalds/linux/tree/master/drivers/net/wireless/mediatek/mt76 Result: Many packets displayed (success)

Adapter: ALFA AWUS036ACS Chipset: rtl8811au Driver: https://github.com/morrownr/8821au-20210708 Result: Many packets displayed (success)

As mentioned before ACM version is on the way thanks to your advice :) so good to know that it will work .

I also have the following adapters that I can test if you wish:

ALFA AWUS036ACHM (mt7610u) Driver: https://github.com/torvalds/linux/tree/master/drivers/net/wireless/mediatek/mt76

ALFA AWUS036ACH (rtl8812au) Driver: https://github.com/morrownr/8812au-20210629

I would be really interested if 8812au would work as i am getting adapter with this chipset as well(ordered from China some time ago and still did not arrived). So if you find some spare time it would be nice to see your test results.

My experience is that users of monitor mode should give priority to the following usb wifi chipsets: (adapters based on all of the below are available for sale as new products currently)

mt7612u (dual band) mt7610u (dual band) rtl8812au (dual band) rtl8811au (dual band) rt5572 (dual band) rt3572 (dual band) rt5372 rt5370 ar9271 rt3070

As per above comment got one from the list on ordered :) But also got adapter with MT7663u chipset and no luck to put it in monitor mode even if the driver is built in kernel - was wonder if you have any information about this specific chipset ?

I advise monitor mode users to avoid adapters based on the following chipsets:

rtl8811cu (8821cu) rtl8812bu (88x2bu) rtl8814au (8814au)

As per your advice and my own experience with two of them (88114au and 8812bu) definetly they are bad choices .

With that said, I see you have an ACM on the way. It should serve you well. In the mean time, I am currently testing a new driver for the 8812bu chipset. The repo is currently private with 4 individuals helping test. I have no intention of supporting monitor mode with that driver but, if you are interested in having access to the repo, I will provide instructions for you to turn on monitor mode for testing. Let me know if you are interested. Regarding the 8814au based adapter. I can start trying to chase the bug if you want but this 8814au driver is old and fragile and I can't gurantee anything. We need a new, modernized version of the source from Realtek but I am not holding my breathe.

If there is a chance to test monitor mode in 8812bu I would definetly want to try and so if you could provide instruction i will be greatful. Regarding 8814au - i think Ill leave it for now as it seems that lot of time is requiried to get it work and as I am getting MT7612 adapter I think that will be my main HW to use.

Thanks again for your time and all great work you have done to help me with this issue.

Thanks Greg

[morrownr]

Greg,

I've been really busy trying to get a new 88x2bu driver ready to go public. I'll try to get back to some of your questions and replies when I have a little time. Would you point me to a link to the adapter based on the mt7663u? I have yet to find one available on the market. The driver is in the kernel but I have no experience with this chipset.

[morrownr]

@greg2891

88x2bu ready for test. Go to:

https://github.com/morrownr/88x2bu-20210702

Once you have cloned the repo, you will need to edit one line in the Makefile:

CONFIG_WIFI_MONITOR = n -> CONFIG_WIFI_MONITOR = y

Save the file and then run the installation scipt.

Let me know the results.

Nick

[greg2891]

Thanks Nick Will test it as soon as possible and let you know how it went . Also will try to test this driver with iperf for throughput and with attenuator for dynamic range once setup is ready . Regards Greg

[tiagogalvao]

Hello! I just noticed this thread. I have one rtl8814au with me and noticed that it's indeed not capturing a few things. I have never worked with drivers, but I can try something if you give me some directions. Where should I start to look? Thanks in advance!

[morrownr]

Hi @tiagogalvao

I'll be glad to get you going but it will take far more than one reply in a bug report. If you look at the top, in the main menu, for a button that says Discussions, go there and post a message about learning to work on drivers and I'll stop by and give you some homework.

Nick

[greg2891]

Hi @tiagogalvao

I'll be glad to get you going but it will take far more than one reply in a bug report. If you look at the top, in the main menu, for a button that says Discussions, go there and post a message about learning to work on drivers and I'll stop by and give you some homework.

Nick

Ill be also interested to learn so ill join the class ;)

[morrownr]

@greg2891 @tiagogalvao

This driver does need help. You probably can learn a lot and have some fun working on it but I need both of you understand right up front that this is not something you can master in a couple of hours. If you really want to work on this driver, one of you should start a thread with an appropriate title in Discussions and as I have time, I will help out.

Nick

[tiagogalvao]

Just did it: https://github.com/morrownr/8814au/discussions/51 Thanks a ton!