Documentation/networking/mac80211-injection.rst

Source file repositories/reference/linux-study-clean/Documentation/networking/mac80211-injection.rst

File Facts

System
Linux kernel
Corpus path
Documentation/networking/mac80211-injection.rst
Extension
.rst
Size
3591 bytes
Lines
107
Domain
Support Tooling And Documentation
Bucket
Documentation
Inferred role
Support Tooling And Documentation: documentation
Status
atlas-only

Why This File Exists

Repository support layer: documentation, build tooling, samples, user-space helper tools, generated initramfs support, licenses, and validation utilities.

Dependency Surface

Detected Declarations

Annotated Snippet

.. SPDX-License-Identifier: GPL-2.0

=========================================
How to use packet injection with mac80211
=========================================

mac80211 now allows arbitrary packets to be injected down any Monitor Mode
interface from userland.  The packet you inject needs to be composed in the
following format::

 [ radiotap header  ]
 [ ieee80211 header ]
 [ payload ]

The radiotap format is discussed in
./Documentation/networking/radiotap-headers.rst.

Despite many radiotap parameters being currently defined, most only make sense
to appear on received packets.  The following information is parsed from the
radiotap headers and used to control injection:

 * IEEE80211_RADIOTAP_FLAGS

   =========================  ===========================================
   IEEE80211_RADIOTAP_F_FCS   FCS will be removed and recalculated
   IEEE80211_RADIOTAP_F_WEP   frame will be encrypted if key available
   IEEE80211_RADIOTAP_F_FRAG  frame will be fragmented if longer than the
			      current fragmentation threshold.
   =========================  ===========================================

 * IEEE80211_RADIOTAP_TX_FLAGS

   =============================  ========================================
   IEEE80211_RADIOTAP_F_TX_NOACK  frame should be sent without waiting for
				  an ACK even if it is a unicast frame
   =============================  ========================================

 * IEEE80211_RADIOTAP_RATE

   legacy rate for the transmission (only for devices without own rate control)

 * IEEE80211_RADIOTAP_MCS

   HT rate for the transmission (only for devices without own rate control).
   Also some flags are parsed

   ============================  ========================
   IEEE80211_RADIOTAP_MCS_SGI    use short guard interval
   IEEE80211_RADIOTAP_MCS_BW_40  send in HT40 mode
   ============================  ========================

 * IEEE80211_RADIOTAP_DATA_RETRIES

   number of retries when either IEEE80211_RADIOTAP_RATE or
   IEEE80211_RADIOTAP_MCS was used

 * IEEE80211_RADIOTAP_VHT

   VHT mcs and number of streams used in the transmission (only for devices
   without own rate control). Also other fields are parsed

   flags field
	IEEE80211_RADIOTAP_VHT_FLAG_SGI: use short guard interval

   bandwidth field
	* 1: send using 40MHz channel width
	* 4: send using 80MHz channel width
	* 11: send using 160MHz channel width

The injection code can also skip all other currently defined radiotap fields

Annotation

Implementation Notes