Aircrack-ng

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== DEPRECATED ======

**IMPORTANT NOTE**: This page is deprecated, updated documentation can be found [[install_drivers|here]]

====== General ======

The r8187 driver works properly for the Realtek RTL8187L chipset.  Support for the RTL8187B chipset is under development but is not fully working. See [[r8187b]] for the RTL8187B ieee80211 driver.

This page only deals with the ieee80211 version of the r8187 driver. For the mac80211 rtl8187 version see the [[rtl8187|rtl8187 page]].  To understand the differences, see [[install_drivers#mac80211_versus_ieee80211_stacks|mac80211 versus ieee80211 stacks]] write-up.

**IMPORTANT**\\
If you have a new kernel that support mac80211 and includes the new rtl8187 driver then you **MUST** blacklist it otherwise the ieee80211 version of the module below will not work.  See [[r8187#blacklisting_mac80211_driver_version|blacklisting mac80211 driver version]] below.

====== R8187 ======

rmmod the r8187 and rtl8187 modules before proceeding:	 

  ifconfig wlan0 down	 
  rmmod r8187 rtl8187 2>/dev/null
  wget http://dl.aircrack-ng.org/drivers/rtl8187_linux_26.1010.zip
  unzip rtl8187_linux_26.1010.zip
  cd rtl8187_linux_26.1010.0622.2006/
  wget http://patches.aircrack-ng.org/rtl8187_2.6.27.patch
  wget http://patches.aircrack-ng.org/rtl8187_2.6.32.patch
  tar xzf drv.tar.gz
  tar xzf stack.tar.gz
  patch -Np1 -i rtl8187_2.6.27.patch
  patch -Np1 -i rtl8187_2.6.32.patch
  make
  make install

Now reboot your system.  If your card is connected then wlan0 should now be listed in iwconfig.

Please note that a copy of the patch is also included with the aircrack-ng tar file in the "patches" subdirectory.

====== Usage Tips ======
===== Power Settings =====

The transmit power can be adjusted using:

   iwconfig wlan0 txpower <value of 0 to 35>

With 0 being the lowest and 35 being the highest transmit power.  The default is 5 which is normal.  In order to use higher values, you must first "enable" the high power option.  See the next section regarding how to do this.  WARNING: Enabling high power can damage or destroy your wireless device.  Use this feature at your own risk.

It is important to understand that the values are relative power values, not absolute.  Meaning that they do not refer to dBm or mW values.

To view the current setting enter:

   iwlist wlan0 txpower

The system responds with the current setting:

   wlan0     unknown transmit-power information.
   
          Current Tx-Power=5 dBm        (3 mW)

You MUST ignore the dBm and mW labels.  The value of "5" above is the actual value in the  0 to 35 range.  Unfortunately due to driver constraints, the "dBm (3mW)" are also displayed but must be ignored.

See this [[http://forum.aircrack-ng.org/index.php?topic=3138.msg17673#msg17673|posting]] for a more detailed description of the power settings.

===== "highpower" ipriv Setting =====

+++++++++ WARNING +++++++++\\
+++++++++ WARNING +++++++++\\
WARNING: Enabling high power can damage or destroy your wireless device.  Use this feature at your own risk.\\
+++++++++ WARNING +++++++++\\
+++++++++ WARNING +++++++++\\

Starting with the rtl8187_2.6.24v3.patch, there is a iwpriv "highpower" setting you need to set to "1" in order to increase the txpower over the default value.

To enable high power:

   iwpriv wlan0 highpower 1

To disable high power:

   iwpriv wlan0 highpower 0

===== Using Unpatched Driver =====

Although it is highly recommended that you patch the driver, it is possible to use the unpatched driver for injection.  Simply enter this command first "iwpriv wlan0 rawtx 1".

====== Troubleshooting Tips ======
===== Blacklisting mac80211 driver version =====

If you have the file rtl8187.ko in the /lib/modules directory tree then you have two options to blacklist it.  Failure to do this will mean that the ieee80211 r8187 module described on this page will fail to work properly.  Here are the options:

  * Move the file to another area on your system as follows then do "depmod -ae".  Move /lib/modules/$(uname -r)/kernel/drivers/net/wireless/mac80211/rtl8187.ko to a safe place.  The "$(uname -r)" and/or other parts of the path may be different for your distribution/system.  Use "locate 8187.ko" or "find /lib/modules -name *8187*" to find the full path.  After moving it, do "depmod -ae".
  * Edit /etc/modprobe.d/blacklist and add "blacklist rtl8187" as a new line.

In both cases, reboot your system afterwards.

===== "sh wlan0up" fails =====
Running "sh wlan0up" fails.

Solution:\\
Make sure your ieee80211 stack is built as a module and remove all those modules. If it is integrated in the kernel, rebuild your kernel with a modular ieee80211 stack.


===== wlan0 device does not exist message =====
Trying to run "sh wlan0up" gives you an error of wlan0 device not existing. **lsusb** indicates that the wireless card is connected.

Solution:\\
You sometimes get this message when another driver, which also creates an wlanX interface is loaded before the r8187 driver. Examples: acx111, hostap and all mac80211 drivers. In such a case the rtl8187 device will be wlan1 or wlan2. Look at iwconfig to see if there is such an interface and use that one instead.

===== Module loading errors =====

The following errors were on Ubuntu:
  insmod: error inserting 'ieee80211_crypt-rtl.ko': -1 Invalid module format
  insmod: error inserting 'ieee80211_crypt_wep-rtl.ko': -1 Unknown symbol in module
  insmod: error inserting 'ieee80211_crypt_tkip-rtl.ko': -1 Unknown symbol in module
  insmod: error inserting 'ieee80211_crypt_ccmp-rtl.ko': -1 Unknown symbol in module
  insmod: error inserting 'ieee80211-rtl.ko': -1 Unknown symbol in module
  insmod: error inserting 'r8187.ko': -1 Unknown symbol in module

Solution:\\
  cd beta-8187
  rm -f Modules.symvers
  ln -s ../ieee80211/Modules.symvers Modules.symvers
  ### NOTE versions of GCC may require this instead: ln -s ../ieee80211/Module.symvers Module.symvers
  cd ..
  sh makedrvbk

===== Eliminating Warnings =====
Messages below when compiling the RTL8187 driver on Ubuntu 6.10 with 2.6.17-11 generic (patched for Nvidia) kernel.

  WARNING: "ieee80211_wx_get_name_rtl7" [/root/drivers/rtl8187_linux_26.1025.0328.2007/rtl8187/r8187.ko] undefined!
  WARNING: "free_ieee80211_rtl7" [/root/drivers/rtl8187_linux_26.1025.0328.2007/rtl8187/r8187.ko] undefined!
  WARNING: "ieee80211_wx_get_freq_rtl7" [/root/drivers/rtl8187_linux_26.1025.0328.2007/rtl8187/r8187.ko] undefined!
  WARNING: "alloc_ieee80211_rtl7" [/root/drivers/rtl8187_linux_26.1025.0328.2007/rtl8187/r8187.ko] undefined!
  #many messages suppressed...
  WARNING: "ieee80211_wx_get_scan_rtl7" [/root/drivers/rtl8187_linux_26.1025.0328.2007/rtl8187/r8187.ko] undefined!
  WARNING: "ieee80211_wx_set_rate_rtl7" [/root/drivers/rtl8187_linux_26.1025.0328.2007/rtl8187/r8187.ko] undefined!

Generally, warnings can be ignored.  To eliminate the ones above, follow the instructions in the previous troubleshooting tip.  IE Remake the link to Modules.symvers and then re-compile.

===== Missing files or directory =====

Compiling results in an error similar to:

  make: *** /lib/modules/2.6.15-28-386/build: No such file or directory.
  #Plus other references to "No such file or directory."\\

Solution:\\
See [[install_aircrack#troubleshooting_tips|installing missing packages]].\\

===== "Operation not permitted" error message =====

While loading the modules you get an "Operation not permitted" message similar to:

  insmod: error inserting 'ieee80211_crypt-rtl.ko': -1 Operation not permitted
  insmod: error inserting 'ieee80211_crypt_wep-rtl.ko': -1 Operation not permitted
  insmod: error inserting 'ieee80211_crypt_tkip-rtl.ko': -1 Operation not permitted
  insmod: error inserting 'ieee80211_crypt_ccmp-rtl.ko': -1 Operation not permitted
  insmod: error inserting 'ieee80211-rtl.ko': -1 Operation not permitted
  insmod: error inserting 'r8187.ko': -1 Operation not permitted
  wlan0: ERROR while getting interface flags: No such device

Solution: You must be root to load the modules. You "su" to root then load the modules. On many distributions, you can also do this by using sudo plus the script name.

===== "linux/config.h no such file or directory..." compile error message =====

You receive a compile error messages similar to one or more of:

  * /usr/src/redhat/BUILD/rtl8187_linux_26.1025.0328.2007/ieee80211/ieee80211_rx.c:46:26: error: linux/config.h: No such file or directory
  * /usr/src/redhat/BUILD/rtl8187_linux_26.1025.0328.2007/rtl8187/r8187.h:50:26: error: linux/config.h: No such file or directory
  * "linux/config.h no such file or directory...".
  * In French: "erreur: linux/config.h : Aucun fichier ou répertoire de ce type".

Solution:  You need to create an empty file called linux/config.h in the kernel source directory.  The simplest way is:

"touch /usr/src/kernels/2.6.18-1.2869.fc6-i686/include/linux/config.h"

Change "/usr/src/kernels/2.6.18-1.2869.fc6-i686" to where your kernel sources are located and the your specific kernel and directory structure.  You can use "uname -r" to help determine your exact kernel.

===== "passed 3 arguments, but takes just 2..." compile error message =====

You get compile errors similar to:

  /root/rtl8187_linux_26.1025.0328.2007/ieee80211/ieee80211_softmac.c:2168:78: error: macro "INIT_WORK" passed 3 arguments, but takes just 2
  /root/rtl8187_linux_26.1025.0328.2007/ieee80211/ieee80211_softmac.c: In function ‘ieee80211_softmac_init’:
  /root/rtl8187_linux_26.1025.0328.2007/ieee80211/ieee80211_softmac.c:2168: error: ‘INIT_WORK’ undeclared (first use in this function)

and so on...

  /root/rtl8187_linux_26.1025.0328.2007/rtl8187/r8187_core.c:1625:64: error: macro "INIT_WORK" passed 3 arguments, but takes just 2
  /root/rtl8187_linux_26.1025.0328.2007/rtl8187/r8187_core.c: In function ‘rtl8180_init’:
  /root/rtl8187_linux_26.1025.0328.2007/rtl8187/r8187_core.c:1625: error: ‘INIT_WORK’ undeclared (first use in this function)

and so on...

Solution: This typically occurs after you have upgraded your kernel version. Delete the all the patch files and install a fresh version.  You should now be able to compile it successfully. Also ensure that you have matching kernel header files.

===== Low injection rates =====
Many people complain that they only get injection rates of about 50 packets per second. Here are few items which are known to cause this:

  * Using VMware Workstation 5.x or earlier. Be sure to use VMware Workstation 6 or above. The root cause is that older versions (< 6.0) use the old USB standard.
  * Using VMware Players earlier then version 2. Be sure to use VMware Player 2 or above. The root cause is that older versions (< 2.0) use the old USB standard.
  * Using pre-2.0 USB standard hardware. Make sure you are using hardware with support for USB 2.0.
  * Having legacy USB support enabled in your BIOS. Try disabling this option.

**Note:** VMWare Workstation > 6.0 and VMWare Player > 2.0 use USB 1.1 and when injecting at high speed, injection uses all USB bandwith (so, nearly no packets are received) and you can notice a lot of packets lost in airodump-ng.


===== Ubuntu 7.10 Info =====

== Pre requirements ==

   sudo -s
   apt-get install build-essential
   apt-get install libssl-dev

== Delete old driverfiles ==
You have to check the path first, maybe you must replace this "2.6.22-14-generic". To do this just look what kernel version you use.

   sudo -s
   uname -r


And then delete the files.  Change "2.6.22-14-generic" to your specific kernel version. FIXME These should be either blacklisted or moved to backup directory, not destructively deleted, especially ieee80211.ko!

   rm -rf /lib/modules/2.6.22-14-generic/ubuntu/wireless/rtl818x/rtl8187.ko
   rm -rf /lib/modules/2.6.22-14-generic/ubuntu/wireless/rtl8180/rtl_ieee80211/ieee80211-rtl.ko
   rm -rf /lib/modules/2.6.22-14-generic/kernel/net/ieee80211/ieee80211.ko
   rm -rf /lib/modules/2.6.22-14-generic/kernel/net/ieee80211/ieee80211_crypt.ko
   rm -rf /lib/modules/2.6.22-14-generic/kernel/net/ieee80211/ieee80211_crypt_wep.ko
   rm -rf /lib/modules/2.6.22-14-generic/kernel/net/ieee80211/ieee80211_crypt_ccmp.ko
   rm -rf /lib/modules/2.6.22-14-generic/kernel/net/ieee80211/ieee80211_crypt_tkip.ko

After this proceed with the guide at the top of this page.

===== Optimizing injection rates =====
Some people have reported that including "-x 250" on the aireplay-ng command optimizes their injection rates.  You will have to experiment to see if this helps you or not.

===== "SKB BUG" Error Messages =====

You receive messages similar to this to the console and system log files:

   SKB BUG: Invalid truesize (304) len=226, sizeof(sk_buff)=176

The root cause of these messages is not known at this point in time.  They can be hidden by the following means:

  * To remove them from the console: "dmesg -n2"
  * To remove them from system log files, edit /etc/syslog.conf or /etc/rsyslog.conf depending on your system.  Add "kern.!debug" to definition of each file receiving the debug messages.

Another more radical approach is to comment out the kernel messages in the kernel source code.  This will also mean recompiling your kernel.

Change net/core/skbuff.c in your kernel source:

   void skb_truesize_bug(struct sk_buff *skb)
   {
         printk(KERN_ERR "SKB BUG: Invalid truesize (%u) "
                "len=%u, sizeof(sk_buff)=%Zd\n",
                skb->truesize, skb->len, sizeof(struct sk_buff));
   }
   EXPORT_SYMBOL(skb_truesize_bug);

to:

   void skb_truesize_bug(struct sk_buff *skb)
   {
   (void)skb;
   //      printk(KERN_ERR "SKB BUG: Invalid truesize (%u) "
   //             "len=%u, sizeof(sk_buff)=%Zd\n",
   //             skb->truesize, skb->len, sizeof(struct sk_buff));
   }
   EXPORT_SYMBOL(skb_truesize_bug);

This effectively eliminates the kernel from reporting the SKB BUG messages.

===== "iwe_stream_add_event" compile error message =====

If you get a series of compile messages similar to "error: passing argument 1 of 'iwe_stream_add_event' from incompatible pointer type" then do the following:

Use

  wget http://patches.aircrack-ng.org/rtl8187_2.6.27.patch

instead of

  wget http://patches.aircrack-ng.org/rtl8187_2.6.24v3.patch

in the instructions at the top of the page.

===== "asm/semaphore.h: No such file or directory" compile error message =====

See this [[http://forum.aircrack-ng.org/index.php?topic=4305.msg24483#msg24483|forum entry]]:

Please note a repair apparently needed in ' rtl8187_2.6.27.patch' for kernel 2.6.27 +/-

Unmodified, you will get the following error :
 -- output from ' make ' :
  ...In file included from /usr/src/drivers/rtl8187_linux_26.1010.0622.2006/beta-8187/r8187_core.c:65:
     /usr/src/drivers/rtl8187_linux_26.1010.0622.2006/beta-8187/r8187.h:47:27: error: asm/semaphore.h: No such file or directory


Modification to file    r8187.h   :
    lines 46,47 are :
      #include <asm/io.h>
      #include <asm/semaphore.h>

    overwrite lines 46,47 to this....
      #if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19))
        #include <asm/io.h>
        #include <asm/semaphore.h>
      #else
        #include <linux/io.h>
        #include <linux/semaphore.h>
      #endif


===== Will not compile on kerner 2.6.31 or above =====

Follow the patching instructions at the top of this page then:

   wget http://github.com/nopper/archpwn/raw/master/repo/lkm-skel/rtl8187-ng/rtl8187-ng-2.6.31.patch
   patch -Np1 -i rtl8187-ng-2.6.31.patch

Then proceed with make/make install.

====== Limitations ======

===== Injected Packets are not Captured =====

While in monitor mode, airodump-ng will not capture or record any packets injected by the aircrack-ng suite.  This is a known problem with the driver.

===== Shared Key Authentication fails in managed mode =====

You receive one or more errors similar to:

  * Attempting to setup SKA mode: "iwconfig wlan0 mode managed key 1234567890 restricted"  results in:
   
   Error for wireless request "Set Encode" (8B2A) :
   SET failed on device wlan0 ; Operation not supported.

  *  ieee80211_auth_challenge_rt17+0x2fe/0x310 [ieee80211_rtl] kernel panic

SKA is not currently supported with the RTL8187 driver. There is no known workaround.

===== WPA/WPA2 fails in managed mode =====

On recent kernels, the patched driver fails to work in normal WPA/WPA2 mode.  In this case, use the patched ieee80211 driver for injection and use the mac80211 version for normal WPA/WPA2.  In order to do this you will have to blacklist the unwanted module based what you plan to use your system for.  IE For injection, blacklist the rtl8187 module.  For WPA/WPA2, blacklist the r8187 module.