17c37a38dSSam Leffler 27c37a38dSSam LefflerThis tool generates raw 802.11 frames. The resulting frame will 37c37a38dSSam Lefflerdepend on the capabilities of the hardware. Some hardware mangles 47c37a38dSSam Lefflerthe 802.11 header [e.g. wi] other hardware does not [e.g. ath]. 57c37a38dSSam LefflerThis tool does not deal with layers above 802.11. A payload from 67c37a38dSSam Lefflera file must be supplied if, for example, IP data needs to be sent. 77c37a38dSSam Leffler 87c37a38dSSam LefflerRefer to the usage for a complete list of options. Here, the most 97c37a38dSSam Lefflerrelevant will be described. There are three types of switches: 107c37a38dSSam Leffler 117c37a38dSSam Lefflerphysical layer Physical parameters for transmission 127c37a38dSSam Leffler [such as iface and chan]. 137c37a38dSSam Leffler802.11 header Fields in the 802.11 header. 147c37a38dSSam Leffler802.11 body The payload of the 802.11 frame. This includes 157c37a38dSSam Leffler management information elements. 167c37a38dSSam Leffler 177c37a38dSSam LefflerInteresting physical layer options. 187c37a38dSSam Leffler----------------------------------- 197c37a38dSSam Leffler-i The network interface to use to TX; defaults to ath0. 207c37a38dSSam Leffler-c The channel to TX on; defaults to 1. 217c37a38dSSam Leffler-N Mark transmitted frames such that no ACK is expected. In practice, 227c37a38dSSam Leffler this will disable any retransmission done by the card. This 237c37a38dSSam Leffler way, you are sure that a single copy of your packet will be TXed. 247c37a38dSSam Leffler-V Verify that the packet you TXed did indeed fly in the air as 257c37a38dSSam Leffler expected. This is done by sniffing on a second network interface 267c37a38dSSam Leffler and comparing the received frame to what was sent. This option 277c37a38dSSam Leffler is especially useful because some cards mangle 802.11 header 287c37a38dSSam Leffler fields such as duration and fragment numbers. 297c37a38dSSam Leffler-W The WME AC to use for transmission. Symbolic names are used: 307c37a38dSSam Leffler ac_be, be best effort 317c37a38dSSam Leffler ac_bk, bk background 327c37a38dSSam Leffler ac_vi, vi video 337c37a38dSSam Leffler ac_vo, vo voice 347c37a38dSSam Leffler-X The rate to use for transmission; defaults to 1Mbps. 357c37a38dSSam Leffler-P The txpower to use; defaults to the maximum permitted by the driver. 367c37a38dSSam Leffler 377c37a38dSSam LefflerInteresting 802.11 header options. 387c37a38dSSam Leffler---------------------------------- 397c37a38dSSam Leffler-t The 802.11 frame type. Symbolic names are: 407c37a38dSSam Leffler mgt Management frame 417c37a38dSSam Leffler ctl Control frame 427c37a38dSSam Leffler data Data frame 437c37a38dSSam Leffler Otherwise the numerical type must be supplied. 447c37a38dSSam Leffler-s The 802.11 frame subtype. At this point, the length of the 802.11 header 457c37a38dSSam Leffler will be calculated. Symbolic names are: 467c37a38dSSam Leffler preq, probereq Probe Request 477c37a38dSSam Leffler auth Authenticate 488ce070c1SUlrich Spörlein areq, assocreq Association Request 497c37a38dSSam Leffler data Data 507c37a38dSSam Leffler Otherwise the numerical subtype must be supplied. 517c37a38dSSam Leffler-4 The 4th MAC addr used for WDS. Make sure you specify this before 527c37a38dSSam Leffler -s so the header length is calculated correctly. 537c37a38dSSam Leffler-l Override the length of the packet. This is useful for sending 547c37a38dSSam Leffler truncated packets. 557c37a38dSSam Leffler-b Specify a file which will be used as a payload inside the 802.11 567c37a38dSSam Leffler frame. The length should be calculated automatically correctly. 577c37a38dSSam Leffler 587c37a38dSSam LefflerInteresting 802.11 payload options. 597c37a38dSSam Leffler----------------------------------- 607c37a38dSSam LefflerThis is mainly used for management frames. For data frames, -b 617c37a38dSSam Lefflerwould typically be used. 627c37a38dSSam Leffler 637c37a38dSSam Leffler-e Add an information element. You can supply multiple -e options, 647c37a38dSSam Leffler but make sure you add them in the expected order. The format 657c37a38dSSam Leffler of the information element is a list of 2 digit hex numbers. 667c37a38dSSam Leffler That is, 010203... The first hexdigit is the type of the IE. 677c37a38dSSam Leffler Therefore, 00616161 should correspond to the SSID IE of 'aaa'. 687c37a38dSSam Leffler The length is calculated automatically---you do not need to 697c37a38dSSam Leffler supply it. 707c37a38dSSam Leffler-S Add an SSID IE with the data specified in ascii; e.g. -S 'aaa' 717c37a38dSSam Leffler is the equivalent of -e 0061616161. 727c37a38dSSam Leffler-R Add an IE of 11b supported rates. 737c37a38dSSam Leffler 747c37a38dSSam LefflerExamples: 757c37a38dSSam Leffler--------- 767c37a38dSSam Leffler 777c37a38dSSam Lefflerwlaninject -t data -s data -i ral0 -V ath0 -m -n 1 -f 1 787c37a38dSSam Leffler 797c37a38dSSam LefflerTransmit a data frame on ral0 and verify the transmission on ath0. 807c37a38dSSam LefflerThe frame is sent with sequence number 1, fragment number 1, and 817c37a38dSSam Lefflerthe MoreFrag bit marked in the 802.11 header. 82