How to Measure the Received Signal Strength of WiFi Beacons

http://pharos.ece.utexas.edu/wiki/index.php/How_to_Measure_the_Received_Signal_Strength_of_WiFi_Beacons

To measure the received signal strength (RSS) of WiFi beacons, we need to create a monitor mode interface that snoops beacons received by the WiFi card and tcpdump to log statistics about these beacons.

Contents

 [hide] 

• 1 Creating a Monitor Mode Interface
• 2 Using tcpdump to Log Signal Strength Data
• 3 Removing the Monitor Mode Interface
• 4 Wireless Signal Strength in Java

Creating a Monitor Mode Interface

Creating a monitor mode interface depends on which driver you are using. The following instructions assume you are using the ath5k driver with a wireless card based on the Atheros chipset. Thus, we will use program iw to create a monitor mode interface. If you are using the MadWiFi driver, you will use wlanconfig instead of iw to create the monitor mode interface.

First determine the physical name of the WiFi interface in your system. Do this by executing iw list. For example, the output below indicates that the name of the physical device is "phy0".

ut@proteus:~$ iw listWiphy phy0        Band 1:                Frequencies:                        * 2412 MHz [1] (27.0 dBm)                        * 2417 MHz [2] (27.0 dBm)                        * 2422 MHz [3] (27.0 dBm)                        * 2427 MHz [4] (27.0 dBm)                        * 2432 MHz [5] (27.0 dBm)                        * 2437 MHz [6] (27.0 dBm)                        * 2442 MHz [7] (27.0 dBm)                        * 2447 MHz [8] (27.0 dBm)                        * 2452 MHz [9] (27.0 dBm)                        * 2457 MHz [10] (27.0 dBm)                        * 2462 MHz [11] (27.0 dBm)                        * 2467 MHz [12] (disabled)                        * 2472 MHz [13] (disabled)                        * 2484 MHz [14] (disabled)                Bitrates (non-HT):                        * 1.0 Mbps                        * 2.0 Mbps (short preamble supported)                        * 5.5 Mbps (short preamble supported)                        * 11.0 Mbps (short preamble supported)                        * 6.0 Mbps                        * 9.0 Mbps                        * 12.0 Mbps                        * 18.0 Mbps                        * 24.0 Mbps                        * 36.0 Mbps                        * 48.0 Mbps                        * 54.0 Mbps        Band 2:                Frequencies:                        * 5180 MHz [36] (17.0 dBm)                        * 5200 MHz [40] (17.0 dBm)                        * 5220 MHz [44] (17.0 dBm)                        * 5240 MHz [48] (17.0 dBm)                        * 5260 MHz [52] (20.0 dBm) (passive scanning, no IBSS, radar detection)                        * 5280 MHz [56] (20.0 dBm) (passive scanning, no IBSS, radar detection)                        * 5300 MHz [60] (20.0 dBm) (passive scanning, no IBSS, radar detection)                        * 5320 MHz [64] (20.0 dBm) (passive scanning, no IBSS, radar detection)                        * 5500 MHz [100] (20.0 dBm) (passive scanning, no IBSS, radar detection)                        * 5520 MHz [104] (20.0 dBm) (passive scanning, no IBSS, radar detection)                        * 5540 MHz [108] (20.0 dBm) (passive scanning, no IBSS, radar detection)                        * 5560 MHz [112] (20.0 dBm) (passive scanning, no IBSS, radar detection)                        * 5580 MHz [116] (20.0 dBm) (passive scanning, no IBSS, radar detection)                        * 5600 MHz [120] (disabled)                        * 5620 MHz [124] (disabled)                        * 5640 MHz [128] (disabled)                        * 5660 MHz [132] (20.0 dBm) (passive scanning, no IBSS, radar detection)                        * 5680 MHz [136] (20.0 dBm) (passive scanning, no IBSS, radar detection)                        * 5700 MHz [140] (20.0 dBm) (passive scanning, no IBSS, radar detection)                        * 5745 MHz [149] (30.0 dBm)                        * 5765 MHz [153] (30.0 dBm)                        * 5785 MHz [157] (30.0 dBm)                        * 5805 MHz [161] (30.0 dBm)                        * 5825 MHz [165] (30.0 dBm)                Bitrates (non-HT):                        * 6.0 Mbps                        * 9.0 Mbps                        * 12.0 Mbps                        * 18.0 Mbps                        * 24.0 Mbps                        * 36.0 Mbps                        * 48.0 Mbps                        * 54.0 Mbps        max # scan SSIDs: 4        Supported interface modes:                 * IBSS                 * managed                 * AP                 * AP/VLAN                 * monitor                 * mesh point        Supported commands:                 * new_interface                 * set_interface                 * new_key                 * new_beacon                 * new_station                 * new_mpath                 * set_mesh_params                 * set_bss                 * authenticate                 * associate                 * deauthenticate                 * disassociate                 * join_ibss                 * Unknown command (55)                 * Unknown command (57)                 * Unknown command (59)                 * set_wiphy_netns                 * Unknown command (65)                 * connect                 * disconnect

Now that you have determined the WiFi interface is phy0, here is the command create a monitor mode interface that snoops the wifi interface. Note that it names the monitor mode interface moni0.

$ sudo iw phy phy0 interface add moni0 type monitor

You can list all interfaces using ip link. Here is example output. Note that "moni0" now appears.

ut@proteus:~$ ip link1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:002: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000    link/ether 00:40:63:f5:60:1b brd ff:ff:ff:ff:ff:ff3: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 1000    link/ether 00:1b:b1:00:99:78 brd ff:ff:ff:ff:ff:ff5: moni0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000    link/ieee802.11/radiotap 00:1b:b1:00:99:78 brd ff:ff:ff:ff:ff:ff

Before you can access the new moni0 interface, you need to bring it up:

$ sudo ifconfig moni0 up

Using tcpdump to Log Signal Strength Data

You can now use tcpdump to capture traffic received over the wireless interface (view the man pages of tcpdump to understand what all the options mean):

$ sudo tcpdump -n -e -tttt -vvv -i moni0 -s 0 -w moni0.dump "link[0] == 0x80"

The command above will log the beacon receptions to a file called "moni0.dump". This is a binary file that needs to be transformed into human readable format. Here's how to do that:

sudo tcpdump -nettvvv -s 0 -r moni0.dump > moni0.dump.txt

The RSS statistics should now be in file moni0.dump.txt.

Removing the Monitor Mode Interface

To delete a monitor mode interface:

$ sudo iw dev moni0 del

Wireless Signal Strength in Java

OS X Robot has to ping your computer first

public static void main(String[] args){ Process process = null;        BufferedReader input = null;         PrintWriter out = null;        String line = null;                              {                   try {                                process= Runtime.getRuntime().exec("tcpdump -I -s 256 -i en1");                    input = new BufferedReader(new InputStreamReader(process.getInputStream()));                    out = new PrintWriter(new FileWriter("output2.txt"));                                                                                 } catch (IOException e1) {                     e1.printStackTrace();                       System.exit(1);                 }                                                 try {                        while( (line=input.readLine())!=null) {                           int index = line.indexOf("10.11.12.26 >");                                     if(index != -1){                       // System.out.println(index);                       System.out.println(line);                       //System.out.println(line.substring(77, 81)); print just the signal                       out.println(line);                                                }                       }                      out.close();                } catch (IOException e1) {                     e1.printStackTrace();                       System.exit(0);                 }                                                 }       }