AP를 설정할 수 있지만 AP에 대한 모니터 인터페이스와 채널을 명시적으로 설정했음에도 불구하고 AP 주파수가 주기적으로 변경됩니다.
내 설정:
- 운영 체제: Kali Linux 1.0(USB 드라이브에서 부팅)
- 외부 네트워크 어댑터: Alfa AWUS036NH(칩셋 Ralink RT2870/3070, 드라이버: rt2800usb)
- 온보드 네트워크 어댑터: Atheros(칩셋 AR9485, 드라이버: ath9k)
내가 달성하고 싶은 것:
- Alfa 어댑터의 채널 6에서 실행되는 AP 생성
내가 뭘 한거지:
root@kali:~# ifconfig
eth0 Link encap:Ethernet HWaddr dc:0e:a1:28:8f:fc
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
Interrupt:16
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:8 errors:0 dropped:0 overruns:0 frame:0
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:480 (480.0 B) TX bytes:480 (480.0 B)
wlan0 Link encap:Ethernet HWaddr 9c:b7:0d:04:d2:f5
inet addr:192.168.2.140 Bcast:192.168.2.255 Mask:255.255.255.0
inet6 addr: fe80::9eb7:dff:fe04:d2f5/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:105 errors:0 dropped:0 overruns:0 frame:0
TX packets:29 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:11692 (11.4 KiB) TX bytes:2834 (2.7 KiB)
wlan3 Link encap:Ethernet HWaddr 00:c0:ca:59:23:d0
inet addr:192.168.2.223 Bcast:192.168.2.255 Mask:255.255.255.0
inet6 addr: fe80::2c0:caff:fe59:23d0/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:21 errors:0 dropped:0 overruns:0 frame:0
TX packets:10 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1572 (1.5 KiB) TX bytes:1300 (1.2 KiB)
root@kali:~# iwconfig
eth0 no wireless extensions.
lo no wireless extensions.
wlan3 IEEE 802.11bgn ESSID:"SomeNetwork"
Mode:Managed Frequency:2.437 GHz Access Point: 0A:60:6E:EA:96:31
Bit Rate=13 Mb/s Tx-Power=20 dBm
Retry long limit:7 RTS thr:off Fragment thr:off
Encryption key:off
Power Management:on
Link Quality=70/70 Signal level=-27 dBm
Rx invalid nwid:0 Rx invalid crypt:0 Rx invalid frag:0
Tx excessive retries:0 Invalid misc:2 Missed beacon:0
wlan0 IEEE 802.11bgn ESSID:"SomeNetwork"
Mode:Managed Frequency:2.437 GHz Access Point: 0A:60:6E:EA:96:31
Bit Rate=1 Mb/s Tx-Power=16 dBm
Retry long limit:7 RTS thr:off Fragment thr:off
Encryption key:off
Power Management:off
Link Quality=70/70 Signal level=-39 dBm
Rx invalid nwid:0 Rx invalid crypt:0 Rx invalid frag:0
Tx excessive retries:2 Invalid misc:25 Missed beacon:0
root@kali:~# ifconfig wlan3 down
root@kali:~# ifconfig
eth0 Link encap:Ethernet HWaddr dc:0e:a1:28:8f:fc
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
Interrupt:16
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:8 errors:0 dropped:0 overruns:0 frame:0
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:480 (480.0 B) TX bytes:480 (480.0 B)
wlan0 Link encap:Ethernet HWaddr 9c:b7:0d:04:d2:f5
inet addr:192.168.2.140 Bcast:192.168.2.255 Mask:255.255.255.0
inet6 addr: fe80::9eb7:dff:fe04:d2f5/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:125 errors:0 dropped:0 overruns:0 frame:0
TX packets:29 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:15214 (14.8 KiB) TX bytes:2834 (2.7 KiB)
root@kali:~# iwconfig
eth0 no wireless extensions.
lo no wireless extensions.
wlan3 IEEE 802.11bgn ESSID:off/any
Mode:Managed Access Point: Not-Associated Tx-Power=20 dBm
Retry long limit:7 RTS thr:off Fragment thr:off
Encryption key:off
Power Management:on
wlan0 IEEE 802.11bgn ESSID:"SomeNetwork"
Mode:Managed Frequency:2.437 GHz Access Point: 0A:60:6E:EA:96:31
Bit Rate=1 Mb/s Tx-Power=16 dBm
Retry long limit:7 RTS thr:off Fragment thr:off
Encryption key:off
Power Management:off
Link Quality=70/70 Signal level=-38 dBm
Rx invalid nwid:0 Rx invalid crypt:0 Rx invalid frag:0
Tx excessive retries:2 Invalid misc:25 Missed beacon:0
root@kali:~# airmon-ng check kill
Found 4 processes that could cause trouble.
If airodump-ng, aireplay-ng or airtun-ng stops working after
a short period of time, you may want to kill (some of) them!
-e
PID Name
3512 NetworkManager
3620 wpa_supplicant
3849 dhclient
4263 dhclient
Process with PID 4263 (dhclient) is running on interface wlan3
Process with PID 3849 (dhclient) is running on interface wlan0
Killing all those processes...
root@kali:~# airmon-ng check kill
root@kali:~# ifconfig
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:12 errors:0 dropped:0 overruns:0 frame:0
TX packets:12 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:720 (720.0 B) TX bytes:720 (720.0 B)
root@kali:~# iwconfig
eth0 no wireless extensions.
lo no wireless extensions.
wlan3 IEEE 802.11bgn ESSID:off/any
Mode:Managed Access Point: Not-Associated Tx-Power=20 dBm
Retry long limit:7 RTS thr:off Fragment thr:off
Encryption key:off
Power Management:on
wlan0 IEEE 802.11bgn ESSID:off/any
Mode:Managed Access Point: Not-Associated Tx-Power=16 dBm
Retry long limit:7 RTS thr:off Fragment thr:off
Encryption key:off
Power Management:off
root@kali:~# iwconfig wlan3 channel 6
root@kali:~# airmon-ng start wlan3 6
Interface Chipset Driver
wlan3 Ralink RT2870/3070 rt2800usb - [phy1]
(monitor mode enabled on mon0)
wlan0 Atheros AR9485 ath9k - [phy0]
root@kali:~# airbase-ng -c 6 -e FreeWiFi mon0
15:04:22 Created tap interface at0
15:04:22 Trying to set MTU on at0 to 1500
15:04:22 Trying to set MTU on mon0 to 1800
15:04:22 Access Point with BSSID 00:C0:CA:59:23:D0 started.
다른 터미널 창에서 mon0에서 airodum-ng를 실행하면 채널 호핑이 발생하는 것을 볼 수 있습니다(CH 값 x가 계속 변경됨).
BSSID PWR Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
00:C0:CA:59:23:D0 0 2969 0 0 x 54 OPN FreeWiFi
at0 인터페이스가 설정되어 있지도 않고 dhcp 서비스가 실행되고 있지도 않지만 이 단계에서는 그것이 중요하지 않다고 생각합니다.
다른 Android 기기에서 WiFi 분석기 앱을 실행했는데, 이 앱을 통해 내 불량 AP "FreeWiFi"가 실제로 채널 호핑을 하고 있음을 확인했습니다.
질문:
1)wlan3, mon0, AP 채널을 6으로 설정했는데 왜 채널 점프가 발생하나요?
2) AP가 고정 채널에서 작동하도록 하려면 어떻게 해야 합니까?
이 동작을 분석하는 데 추가 정보가 필요한 경우 알려주시기 바랍니다.