Setup

1. Set up a monitor interface on your desired channel.

   1. In the LANforge GUI’s Port Mgr tab, select the wiphy device for your radio, and click Modify.
   2. In the Channel/Freq selector, pick the channel on which you would like to transmit. Make sure that this is not set to AUTO. After configuring, select Apply and OK on the bottom of the window.
   3. Now, keeping your wiphy device selected, click on the Create button on the top of the Port Mgr tab. This will open up the Port Creation menu.
   4. Select WiFi Monitor from the top menu. If you already have a monitor interface on your LANforge device, you may need to edit the STA ID field to give the interface a unique identifier. After doing this, select Apply, and close the window.
   5. Verify that your monitor interface has been created in the Port Mgr tab.

2. Configure a traffic cross-connect to transmit raw 802.11 frames.

   1. From the Layer-3 tab of the LANforge GUI, select Create. This will open the Layer 3 connection editor.
   2. Configure your connection with the following settings:
      1. Name your connection frame-inject-0.
      2. Set the CX Type to Custom / Eth.
      3. Under Endpoint A, configure the Resource and Port fields to match the monitor interface that you just created.
      4. Also under Endpoint A, set Pkts To Send to 1.
      5. Ignore configuration for Endpoint B, we will later disable this.
   3. Select All from the top of the window to reveal further configuration options.
   4. Locate the UnManaged option for Endpoint B under section 5 of the configuration window and select it. This should disable further configuration for Endpoint B. You may need to scroll down to locate this option.
   5. Select Apply to create this cross connect. However, do not close this window, as you still need to configure the exact frame that you would like to transmit.

3. Configure the exact frame to transmit.

   1. Click on the Payload button of Endpoint A in section 4 to configure the 802.11 frame.
   2. Enter the following into the Enter/Create the payload in HEX field. There is no need to edit any other fields, even if they show apparently incorrect information.

    00 00 0e 00 04 8c 00 00 12 0c 01 00 08 00 
    40 00 00 00 ff ff ff ff ff ff 00 de ad be ef 00 ff ff ff ff ff ff 10 00 00 00

   • This text defines a very minimal Probe Request frame from some station with MAC 00:de:ad:be:ef:00, as an example. The first line is Radiotap information, and should not be changed, unless you know what you are doing. The second line is the full transmitted frame, including the IEEE 802.11 header. This can be edited to transmit any frame that you would like.

   • After entering the text, select Apply on the bottom of the window.

   3. Back in the Layer-3 tab of the main GUI window, select the connection that you just created and click Start. This will cause one single frame, as defined by the payload above, to be transmitted.
   4. You should be able to verify that the frame was transmitted with an independent sniffer. You may not be able to see the frame transmitted if using the same interface to sniff as to transmit.

Crafting a Payload

The payload input here is a combination of a Radiotap header, which affects the physical layer, and a raw IEEE 802.11 frame.

To create a custom payload, remember to include both a line indicating the Radiotap header, as well as a following line for the Wi-Fi frame.

Radiotap

The Radiotap header that we suggest for most use cases is

00 00 0e 00 04 8c 00 00 12 0c 01 00 08 00

This is a fairly sane default for transmitting management frames, specifying a 9 Mbps rate, single antenna, 12 dBm tx power, and instructing the hardware to not retry the frame if no ACK is received. More info for constructing a Radiotap header can be found at the official Radiotap website.

Wi-Fi Frame

Any bytes following the Radiotap header will populate the IEEE 802.11 frame, including its header. The following are some known tests that can be performed using frame injection.

RTS Denial of Service - Sending an RTS frame with a large duration

An access point’s susceptibility to RTS denial-of-service attacks can be tested by creating an RTS frame with a large duration field. The following is an example of one such frame:

b4 00 74 01 11 22 33 44 55 66 aa bb cc dd ee fe

Interpreted, per-field:

Remote Deauth

False de-auth frames can be transmitted with this method, which can test a known DOS vector. As an example:

c0 00 3a 01 11 22 33 44 55 66 aa bb cc dd ee fe 11 22 33 44 55 66 10 00 01 00

Interpreted, per-field:

A script that can be used to generate the bytes necessary for a deauthentication frame can be found here:

Alternative method

aireplay-ng can be used with a monitor to trigger deauth frames. Install with dnf install aircrack-ng.

aireplay-ng -0 1 -a a8:f7:d9:c7:83:a1 -c 4c:77:cb:1d:50:47 moni0a

-a is the bssid

-c is the station you want to deauth

More info at https://www.aircrack-ng.org/doku.php?id=deauthentication.