seemoo-lab / nexmon_csi

Channel State Information Extraction on Various Broadcom Wi-Fi Chips
303 stars 121 forks source link

About Rx,Tx configuration with two routers #358

Open maple-42 opened 1 week ago

maple-42 commented 1 week ago

Hello.

Thanks to this nexmon_csi, I was able to get my CSI.

Currently I am getting 1x1x256 as I am getting CSI by connecting my pc to my ASUS router.

I would like to get CSI using two routers, one as Rx and the other as Tx, in order to increase the Rx and Tx antennas, do you know how to do this?

I would appreciate your reply when you have time.

Thank you in advance.

jlinktu commented 1 week ago

Injection based:

Transmitter: If you only wan't to experiment with CSI extraction and don't need a working connection between devices, easiest is probably to use frame injection with e.g. the following patch https://github.com/seemoo-lab/nexmon_tx_task . You can control the number of spatial streams and with that the minimal number of antennas that are used.

Extractor: If you use a Asus RT-AC86U as CSI extractor with our Nexmon CSI patch in the 5 GHz band, the device should be able to receive on all four antennas and for up to four spatial streams by default. Make sure to set parameters -C and -N according to your requirements.

A nice thing about this approach is that you only need two devices. One drawback is that the injected frames don't resemble real traffic (not to confuse, the injected frames are still perfectly valid).

Forcing antenna configurations:

The following works on most Asus APs with Broadcom BCM43 SoCs. Assuming you have three Asus RT-AC86U devices, one serving as AP, one as client, and one as CSI extractor.

Access Point and Client: For each of those two you can configure which transmit and receive chains are active. Make sure to apply these before connecting the client to the AP.

Transmit chains:

wl -i <INTERFACE> txchain <BITMASK>
wl -i <INTERFACE> txcore -k <BITMASK_CCK> -o <BITMASK_OFDM> -s 1 -c <BITMASK_S1> -s 2 -c <BITMASK_S2> -s 3 -c <BITMASK_S3> -s 4 -c <BITMASK_S4>
wl -i <INTERFACE> txcore_override

where <BITMASK> can be 0x1 up to 0xf, indicating, which of the four possible transmit chains can be used. If you want all four chains to be usable, you want to pass 0xf (b'1111) to it. Next up, you can control, which of those chains are used for which modulation. CCK and OFDM should be trivial. BITMASK_S1 to BITMASK_S4 repesent the number of spatial streams from 1 to 4. If you reduced the number of usable transmit chains in the previous command to less than 4, you can only set up to the possible usable number of streams.

Receive chains:

wl -i <INTERFACE> rxchain <BITMASK>

where <BITMASK> can be 0x1 to 0xf, controlling, which of the four possible receive chains can be used. If you want all four chains to be usable, you want to pass 0xf (b'1111) to it.

However, this only controls the available hardware. The AP and STA still might decide to use less streams than possible by the hardware. You can additionally try to enforce a specific rate setting with the following:

wl -i <INTERFACE> <BAND>_rate -v <MCS>x<SPATIAL_STREAMS>
wl -i <INTERFACE> <BAND>_mrate -v <MCS>x<SPATIAL_STREAMS>

where <BAND> can be either 2g or 5g, <MCS> is a VHT MCS index (see https://mcsindex.com/), and <SPATIAL_STREAMS> is the number of spatial streams to use. The first command sets the rate for data transmissions and the second sets the rate for multicast tansmissions.

Extractor: Make sure to set parameters -C and -N according to your requirements.

Note that on the Asus RT-AC86U there are only up to 3 antennas in the 2.4GHz band. Thus, if you want to have 4x4 you should use the 5GHz band.

maple-42 commented 1 week ago

Dear jlinktu.

Thank you for your reply.

I tried to run this as a beginner, but for some reason I could only get 3x3 data.

The following is what I executed on my RX side router.

admin@RT-AC86U:/tmp# /sbin/rmmod dhd admin@RT-AC86U:/tmp# /sbin/insmod /jffs/dhd.ko admin@RT-AC86U:/tmp# wl -i eth6 up admin@RT-AC86U:/tmp# wl -i eth6 radio on admin@RT-AC86U:/tmp# wl -i eth6 country US admin@RT-AC86U:/tmp# ifconfig eth6 up admin@RT-AC86U:/tmp# /jffs/mcp -c 36/80 -C 4 -N 4 KuABRAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA== admin@RT-AC86U:/tmp# admin@RT-AC86U:/tmp# /jffs/nexutil -Ieth6 -s500 -b -l34 -vKuABRAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA== admin@RT-AC86U:/tmp# /usr/sbin/wl -i eth6 monitor 1 admin@RT-AC86U:/tmp# /jffs/tcpdump -i eth6 dst port 5500 -w /tmp/test2.pcap -c 1000

Here is the data obtained from this run.

Hardware: Broadcom BCM4366c0 Backend: Nexmon CSI Bandwidth: 80MHz Antenna Configuration: 3 Rx, 3 Tx Frame Count: 913 Subcarrier Count: 256 Length: 7.22s Average Sample Rate: 126.40Hz CSI Shape: (913, 256, 3, 3)

If there are any errors, please let me know when you have time.

Thank you in advance.

Translated with DeepL.com (free version)

jlinktu commented 1 week ago

Have a look at the README of makecsiparams. If you want to extract on four antennas for four streams you want to pass -C 0xf -N -xf to makecsiparams.

Whatever you used to produce the output:

Hardware: Broadcom BCM4366c0 Backend: Nexmon CSI Bandwidth: 80MHz Antenna Configuration: 3 Rx, 3 Tx Frame Count: 913 Subcarrier Count: 256 Length: 7.22s Average Sample Rate: 126.40Hz CSI Shape: (913, 256, 3, 3)

is not part of this repository. If you encounter issues with processing software, head over to the respective repository or contact the software's authors.