How to use the prismdump utility

Abstract

Prismdump is a small utility which makes it possible to retrieve IEEE 802.11 frames i n raw format from a IEEE 802.11 Wlan NIC based on Intersils Prism II chipset. It has been tested on a RedHat 6.2 distribution with a 2.2.[14-16] kernel and a Compaq WL100 PCMCIA WLAN adapter.

Additional requirements

In order to use the prismdump utility you will need the following:

- A Linux kernel with support for the kernel/user netlink socket. (CONFIG_NETLINK)

- The linux-wlan-ng package (version 0.1.6) from Absolute Value Systems (ftp.absoval.com/pub/linux-wlan-ng). Newer versions do not support monitor-mode and thus need a new plugin(

- A IEEE 802.11b WLAN NIC based on Intersils Prism-II chipset. Any adapter supported by the linux-wlan-ng package should work.

Function

The prismdump utility will connect to your IEEE 802.11 card, retrieve frames from the adapter and save these frames using the Axis wiretap format. You can then load these frames into ethereal by selecting File->open.

Usage directions

In order to use the utility you must follow these steps:

1. Become root
2. Place your WLAN-adapter in what is known as monitor mode (for a description of monitor-mode, see the linux-wlan-ng sources). You do this by using the command
wlanctl-ng  device lnxreq_wlansniff channel=ch enable=true|false.
For example, if you want to listen to all traffic on channel three and your WLAN adapter is WLAN0 you would issue the command: wlanctl-ng WLAN0 lnxreq_WLANsniff channel=3 enable=true.
3. run prismdump with a capture file as the argument. Example could be prismdump test-1.capture
4. Once you are satisfied press CTRL-C to end your capture session.
5. Open the file "test-1.capture" with ethereal.

Known bugs

1. If your interface is not configured correctly prismdump will hang in the recvfrom call and thus CTRL-C will not work. You must then kill it manually.

2. There seems to be a problem with the kernel-user netlink buffers. It overflows when the WLAN is heavily loaded. This is not a bug in prismdump.

Last modified: Tue Nov 14 12:15:59 CET 2000