Sunday War-Sitting

You can't really call it War-Driving when you are sitting in a Lay-Z-Boy with your favorite drink (generic grape Gatorade, aka "DRANK"). So this Sunday, I bring you the first War-Driving story in many moons. Here's the setup ...

This past week I started reading about the new Ubuntu Intrepid alpha releases which among other cool improvements contains the "ath5k" driver which is built right into the latest kernel, 2.6.27 (still in development). The new breed of ath5k driver supports the Atheros card used for the Asus eee PC (horay). So I have installed the latest Xubuntu to my eee PC 2G surf and I have al ready noticed some grand improvements in my WiFi strength. While the "quality" is still not at all accurate, I am now able to connect to distant access points which wouldn't even show up in my list before. Thank you ath5k developers, for saving me from lacking madwifi support. Now on with the show.

This morning I sat down and connected to a nearby school which I had previously only explored from my bedside using "Audrey II" (my old iBook). Installing Wireshark (from their network, thank you) I revealed some interesting packets. Namely ... these right here ...

There were half a dozen packets every thirty seconds or so in broadcast form (hence the destination address ending in .255). In the data portion of the packet was "SynchronEyes". Not having any idea what this was, I did some Googling about it. It ends up that this is some software which teachers can use to set up live exams for their kids. How hard could it possibly be to find a copy of this to download and use? I Googled: intitle:"index of" synchroneyes. The to search result was someones accidental mirror of what I was after.

For this, I went back to my home network and downloaded the software. I also took a copy of that activation key text file. That will come in handy. And while I am at it, I should figure out how I am going to run Windows software on my eee PC running Xubuntu. So I went into terminal and did a "sudo apt-get install wine". Next, I ran wine against the installer.

I opted not to install the Internet Explorer toolbar, thankyouverymuch.

Hooray, ready to launch.

Uh oh, why do you need an e-mail address? I'm not giving you that.

It says that it can't connect to the Internet and my registration is no good. That's fine, because it still opens and runs. With the teacher console I made some ill attempts to start connecting to things. My first attempt was to connect to that address that I first came across sending out the broadcast packets. Still watching with Wireshark I could see that it told me to get lost in the form of a "RST" packet.

Oh wait. I think I understand it now. This is a student looking for a teacher. Let's see what my packets look like when I go searching for "a class to join".

Oops. We're all students waiting for a class I guess.

So I did the obvious thing. I made myself a class and waited for the student to join me. No dice. In Wireshark I could see that the student workstation recognized me as a teacher, but would not automatically join the class I had just created.

This little software package could be a lot of fun if I were to join it during school hours. Then I could create duplicate classes and derail students. Or perhaps I could join as a student, and begin asking insulting questions of the teacher. But then I will be at work while school is in session ruining the possibility of any fun like that.

There is still a lot of network to explore here, but I don't expect I will spend much more time on it. For one, when this particular private network ID looked familiar I did some research on what I was connecting to. It ends up that this school is managed by my old employer who performs network monitoring and security services. When I worked there, I had many conversations with the admin of this network. He is over-stretched, over-worked, and most definitely under-paid. It would be well of me to inform him that he has an unsecured wireless network here which I am sure he is not aware of.

But I will send that e-mail later. I still want to explore a bit.

Kismet Newcore

I was downloading and building Kismet once again today. I have done this a lot lately, because I keep blowing up my OS and having to reinstall.

I decided to go all out and install the "newcore" distribution. This version is available through svn and basically represents what the developers want. It's been built from the ground up to offer easier development, add-ons, and better configuration for the user.

I only really used it for 10 minutes or so. It works. It looks little odd. I'm not sure the graphical representation of packets is really necessary, but of course you can customize all that.



My buddy DM thought it looked a little like Atari 2600 graphics. That got me to thinking about my favorite childhood game "Adventure". That lead to a Google search where I learned that someone made a homebrew Adventure II for the Atari 5200 emulator. Just about the time I got the game to play I had to get back to work.

Also - I joined twitter as "rayhaque", so if you are a fellow twitter feel free to stalk me. I read about the service ages ago and I didn't really understand what it's for. I still don't really get it, but I expect I will figure it out soon. :-)

EEE PC - Migrating to 8.04

Being haunted with some rather odd driver issues I have been thinking about moving to Ubuntu or Xubuntu 8.04 for a good week now. Yesterday I bit the bullet knowing full well that this installation would cripple most of my drivers and leave me fumbling to restore all my broken functionality. But you know ... it wasn't *that* bad.

Creating a Live USB stick of Xubuntu 8.04
This was a bit more challenging than I had imagined. eeeXubuntu (release 3) came with this nice little shell script that does all the work of making a thumbdrive/jumpdrive into an installation source for you, so you can skip out of some lengthy tutorial steps. That script is not part of a standard Xubuntu release, so this is what I did.

1) I needed a copy of mkusbinstall.sh from the eeeXubuntu 7.10 disc. Ths involved booting it up, and copying the file onto a thumbdrive. You can also get it from here. I mirrored it for anyone else attempting this.

2) Next I downloaded and booted up Xubuntu 8.04, and inserted my thumbdrive. Then, I copied the script my thumbdrive out to my home directory.

3) Next I prepared my thumb drive again with fdisk and mkfs. This process is documented very well in this blog entry.

4) You need "syslinux" installed for this script to run. One of the magical factors of Live distributions is installing software. Open up a terminal. Go ahead and do a 'sudo apt-get install syslinux'. This will take a moment or two, and you will be done.

5) Now in your terminal, run the script you copied over earlier like this 'sudo ./mkusbinstall.sh --autodetect'. The rest should be smooth sailing as you just wait for copying to complete. You *will* get a few error messages about symbolic links. But don't mind those.

6) Boot your eee PC up to your thumbdrive and get to installing.

Keep in mind, you will need to install madwifi drivers from source to restore your wireless settings. And there are far more tweaks and hacks to fix the remaining stuff. Since I combined about three different methods myself ... I will not try to offer advice on that topic.

Check the eeeUser.com forums for more info.

Additionally, since installing the latest svn source for the madwifi driver - I am getting about 15 percent better signal quality with the built in Atheros WiFi card. It was enough boost to allow me to connect to a network up the street from my house without using any external cards or antennas. Awesome?

EEE PC - Almost Wardriving

After all my failures yesterday I came to the realization that I would have to find a plan B and execute it. An external USB WiFi adapter might be just what the doctor ordered. Luckily I have access to an entire drawer of Linksys USB WiFi adapters which are just collecting dust.

These adapters use the rt2500 chipset which is pretty well suported thanks to the efforts of this project. I plugged the card in, and it was detected. Simple, right? Well not quite.

It seems that the OS wants to load the rt2500usb driver for this card, even though the card in reality is an rt2570. That would be fine if I wanted to *use* this card to join access points and gain Internet access. But my end goal is to use this as a weapon of wardriving. For that, it did not seem to work well. I set my source in Kismet as "source=rt2500,wlancantenna" and started it up. It detects about 3 wireless devices, but cannot seem to see the high powered b/g cisco devices which are everywhere around me.



This seemed to me to be a driver issue of sorts. Heading back to the project download page I found that there was a stand-alone driver for the rt2570 chipset. I downloaded it, built the module, and installed it - all rather easily. The problem is, when I plug in the card the OS still detects it as an rt2500. This can be fixed by opening up /etc/modprobe.d/blacklist (as root) and adding "blacklist rt2500usb" to the bottom of the file. Note that if you blacklist "rt2500" you will likely end up with a non-functioning setup.

Now, with the card removed and *ALL* "rt" related modules removed - I can reinsert the card and this is the result I get.



Note that while Kismet (in the background of this shot) picks up *EVERYTHING* - the OS now doesn't know how to read the signal levels on what it has found. I'm not sure if that is really a problem. I can live with it.

I have also taken one of these cards, gutted it, and through the miracle of duct tape I have merged it with a single cable cantenna design. It's not a pretty site, but I will take pictures at some point.

My New Toy
I am a bit destracted with this little project this morning because I got a slick new toy for fathers day. It's a Garmin Nuvi 200 which is a GPS "driving assistant" (with lot's of additional toys and uses).

Last night I unboxed it, turned it on, and started immediately setting it up. Yet, everytime I got to the part where it hooks up to satelites - it shut off. It seems that they don't send these out of the factory on a full charge. Thankfully this unut can be charged from USB (unlike some of the competitive models). There is a wall charger accessory which you can buy but really don't need. It comes with a nice mounting kit for your windshield or dash, and a 12v socket adapter too.

I went online and registered my unit, and since I am entitled to a free map update I went ahead and started that up. Alas, it needed to install a browser plugin so I had to reboot into ... Windows XP. :-( I installed the plugin, it warned me that the file download could take hours, I laughed, and started it up. But then I saw that this could take hours - because the file was 2.04GB. Meanwhile Windows XP is asking (for about the fifth time) if I would like to reboot. It had to go and install a bunch of updates and it wouldn't shut the fuck up about them. Knowing that Windows will eventually reboot my PC against my will - I rebooted it myself.

But then when I tried to go through the registration and map download again it said "you all ready got your free maps - now beat it" in so many kind words. I HATE YOU WINDOWS. After some hunting around in the web site I was able to find where I could re-download the file. But when it was completed, I had to wait another 15 minutes while Windows copied 2GB from my Temporary Internet Files - to the Desktop (why do they STILL do things this way? Firefox doesn't!). At this point I was happy to reboot back into Linux where logic still prevails.

This morning I popped out the ashtray in my bug and used my tie clip to lock the GPS onto my dash. Then I drove to work. It's two miles down a straight road and I haven't gotten lost yet (not even once) - but I was itching to see how well this thing works. As I came to where the street splits in all directions it shouted "turn left in zero point one miles" and then when I hit the spot it said "turn left". Nice. Then as I cruised down the road it told me "1.7 miles remaining". As I approached the hospital I decided to throw it a curve ball and I took a sharp right to head up the back of the hospital (opposed to going to the front door lie a visitor would). The Garmin saw that I had turned off and a moment later said "recalculating!". With that, it had a new path for me (which is the way I was heading).

I must say, this is a nice little unit. It will be fun to play with this when we head out to a cabin 350 miles from here for vacation. In the mean time, I wonder if I could rig this into my laptop and use it's GPS capabilities for wardriving?

EEE PC - Replacing the WiFi Card

Over the weekend I went onto eBay and bought myself a Dell TrueMobile 1390 b/g wireless card for my eee PC. I am out to replace the Atheros that comes with it, which just doesn't seem to cut the mustard when it comes to wardriving. I bought the card Sunday night for $15 (shipping and all) and it was in my mailbox Tuesday morning. Thanks US Postal Service! :-)

Back at work I got out my set of screwdrivers and went to work. Installing the card was not difficult, but it was time consuming and a little tedious. As you can imagine, everything in the eee PC is small and fragile. I found this particular forum post to be most helpful in determining how to get the lid off and expose the bottom of the motherboard. With everything back together, I booted it up.

I didn't get the "blue light" on the eee PC which was a little concerning. I hadn't thought of how I would get the card to interact with the buttons or quick keys on the eee PC. Once booted I could see that I had ... no wireless card. Not that I expected the driver to load and for everything to work that simply, but it sure would have been nice.

The first thing I tried to get it working was to look for drivers to install. I ran an apt-cache bcm43xx and I found a utility of sorts which helps to load firmware onto a Broadcom card. Why would I want to play with firmware? It seems you have to. The way this card was designed you have a file available which is used to load the card every time it comes up. This is done pretty simply in Windows using Broadcom drivers. Linux it seems, is another story.

There also seems to be a newer style and older style driver. There have been two projects over the years to make these cards work. The old bcm43xx drive has been written off as a "legacy driver" and everyone seems to be using the new b43 driver instead. All sorts of good information on the topic can be found here. I dove feet first into the instructions on the project page and about midway through realized that while I was not getting any error messages, I was having zero success in getting this to work. Additionally, I was skimming through the instructions and really had no idea what I was doing.

Also I noticed I still had no blue light. I wondered if my "hot key" still works. I did a Fn+F2 - and the light came on. Hooray! But that means all the screwing around I had done trying to load drivers was in vain, because my card was turned off the entire time. Duh. Rather than continue on with my path of driver destruction, I opted to back up my home directory to an SD card and re-install the operating system. My hope was that in reinstalling eeeXubuntu the card would be magically detected and the driver would be loaded for me like the Atheros card was when I installed the first time.

And the survey says ... NO DICE.

A fresh and clean Operating System would not find it. Perhaps an up to date Operating System would find it and use it. Next I performed a "dist-upgrade" knowing that I would probably break a ton of other stuff in the process. The dist upgrade took the better part of four hours. Yes, FOUR HOURS. When it was done, I had new versions of everything - but none of my hardware worked any more, not even the on-board wired NIC. Downer.

After having no luck getting drivers to work I began to wonder if the hardware was even being detected. After all, loading the driver didn't give a single error. I ran an 'lspci' and compared the results with what would see with an Atheros card installed. No wonder, the Dell Broadcom card wasn't being picked up at all by the BIOS. This whole thing had been a waste of time, and $15.

With that, I went downstairs, got out the screwdrivers, and put the Atheros card back in. Then, I reinstalled the eeeXubuntu OS to put me back to ground zero. Ugh.

I am not ready to give up, but whatever I come with is going to have to be external. I did some searching around for information on using the Intel 3945 in the eee PC and I was brought right back to the eeeuser.com forum to find some more bad news. That slot it seems, will not detect anything but an Atheros branded card.

For my next trick ... I am thinking of getting an external USB wireless card and making it part of a cantenna. Then the antenna connection would go right into the can - and a single USB cable would come down to the laptop. More on this revelation later.

EEE PC - Wireless Comparisons

Today, just for giggles I grabbed a spare USB Linksys WiFi b/g adapter off my desk and plugged it into my EEE PC. It was imediately recognized and available for use which I wasn't really expecting. Generally in Ubuntu to have to go through driver hell to make one of these work.

But then ... I couldn't actually join any networks that I found and I really didn't care to. What I was interested in seeing was what the signal strength looked like in comparison with the internal Atheros card. This was easily viualized simply by showing the list of available networks. As you can see by the screenshot here, the external USB was about 20+ percent more powerful.

EEE PC - Updating your MadWiFi driver

I've been doing a little hacking with my madwifi_g driver. I have not been at all impressed with the reception of the card. It seems my old iBook can pull in two more access points than my eee PC ,and at double the signal strength. Thinking that it could be the card, I have found a few ineffective "hacks" to control it's settings. Even though they didn't work, here they are.

Increase your transmit strength
Did you know that you can turn up the transmit power of your Atheros card? Did you know that it's all ready turned up all the way? You can check it with the following command:

ray@eee-q050805:~$ iwconfig ath0
ath0 IEEE 802.11g ESSID:"ODDREE" Nickname:""
Mode:Managed Frequency:2.462 GHz Access Point: 00:90:4C:7E:00:64
Bit Rate:5 Mb/s Tx-Power:17 dBm Sensitivity=1/1
Retry:off RTS thr:off Fragment thr:off
Power Management:off
Link Quality=23/70 Signal level=-72 dBm Noise level=-95 dBm
Rx invalid nwid:1552 Rx invalid crypt:0 Rx invalid frag:0
Tx excessive retries:0 Invalid misc:0 Missed beacon:0

Where it days Tx-Power: 17 dBm, that's your current settings. To turn it down, you would do this:

ray@eee-q050805:~$ sudo iwconfig ath0 txpower 16

The only reason to turn it down is to save on battery. Otherwise, you are just limiting your "reach" and your speed. Theoretically you could turn it up with a value of 18, but 17 is the best the card can do ... which is pretty weak.

Change your Antenna
You can also change the antenna that your card is using. It has two and the driver decides how it uses them. They call that automated balancing "diversity". If you want to force the driver to use one antenna or the other you have to turn off diversity. I wrote these three shell scripts to change the settings around - but I was never able to make it work any better. You would have to run these with sudo.

#Use antenna 1
/sbin/sysctl -w dev.wifi0.diversity=0
/sbin/sysctl -w dev.wifi0.txantenna=1
/sbin/sysctl -w dev.wifi0.rxantenna=1

#Use antenna 2
/sbin/sysctl -w dev.wifi0.diversity=0
/sbin/sysctl -w dev.wifi0.txantenna=2
/sbin/sysctl -w dev.wifi0.rxantenna=2

#Use diversity to choose
/sbin/sysctl -w dev.wifi0.diversity=1

Update your MadWifi Driver
This is not a good idea. At all. But I had to try it. If you do this procedure you may ruine your wireless driver beyond repair (not knowing your skill level in linux). That said, here is what I learned.

The madwifi_g driver and the future driver "ath5k" do not have support for the Atheros card used in the eee PC. If you download new, old, or even "svn source" it will compile cleanly and then not work at all. Digging through a forum I found a guy mentioning that the kind folks at madfifi.org have created a patch to make the code work for us eee PC users. Ths patch is also incorporated into the nightly builds for the driver releases. That means you can download it, compile it, and put it to use.

Download the latest patched source code from: http://snapshots.madwifi.org/special/

Look for the newest releast for madwifi-ng, which is labeled for ar5007 (this is the card that the eee PC uses). Download the source, and then do a 'tar -xzvf filename.tar.gz". Next, cd into that directory in a terminal, and then do a 'make'. If your make fails, ensure that you have installed the 'build-essential' package. Now do a make install. It will probably find your existing driver and offer to remove it for you. Allow it to. Then reboot. You will be using the latest driver, and probably won't notice anything different about it.

Conclusion
While not really accomplishing anything, I think I have pretty well proved that the real problem with the lack of signal strength is because the hardware sucks. For my next project, I am going to look at the specs for the other cards which fit the mini-PCI-express slot (for which there are only two or three manufactured).

When is Proxim going to give us a mini-PCI express b/g/n card?

Edit: A little more research on card strength
It seems that there are really only two other contenders for wireless which have the mini PCI express architecture. Those are the Dell Truemobile 1390 and the Intel 3945. The Intel of course uses an Intel chipset while the Dell uses the popular Broadcom chipset. Both seem to be equally compatible, but as far as "which one is better" I still can't tell.

Perhaps I am silly for wanting to know how powerful a card is as the manufacturers don't seem to really advertise these figures. Dell says "this card makes the Intenet work on the computer" (it's not tht dumb, but nearly). Intel says "15db - depending on power usage" (but doesn't tell you the max possible).

I used a Google tactic to get some information. I searched for "dell 1390 tx-power=" and "intel 3945 tx-power=". I found a lot of sad and disheartened users who couldn't get WPA to work, didn't know how to renew an IP address, etc. But what I really was looking for was a dump of their wireles card statistics. Here are two examples of what I found ...

intel 3945
wlan0 IEEE 802.11g ESSID:"xxxx"
Mode:Managed Frequency:2.462 GHz Access Point: 00:17:9A:52:1A:93
Bit Rate=54 Mb/s Tx-Power=27 dBm

dell 1390
[root@localhost ~]# iwconfig wlan0
wlan0 IEEE 802.11g ESSID:off/any
Mode:Managed Frequency:2.462 GHz Access Point: Not-Associated
Bit Rate:54 Mb/s Tx-Power:32 dBm

If these statistics are accurate, it means that the Intel card does another 10 dBm's of power more than the Atheros card ... but the Dell TrueMobile 1390 nearly doubles up on power. With the low cost and high availibilty of the Dell card, I may need to invest in one.