Virtual Wi-Fi interfaces for simultaneous use of the Wi-Fi adapter in different modes

Virtual Wi-Fi

Setting up a wireless connection takes place in two stages. At the first stage, it is necessary to determine and install the correct driver for the network interface (usually the driver is on the installation medium, but sometimes it has to be installed manually), and then configure it. The second stage consists in choosing a method of managing wireless connections. You will also learn how to simultaneously use a Wi-Fi adapter in different modes, and how to add an AP interface to iw. Therefore, this article will be very useful and will answer some questions.

What is dev and phy for iw command

The airmon-ng program for wireless adapters shows data such as PHY and Interface (Screenshot 1).

The iw program allows you to control the network adapter by addressing it either as a phy device or as a dev interface (Screenshot 2).

PHY (abbreviation from the English Physical layer – physical layer) is an integrated circuit designed to perform the functions of the physical layer of the OSI network model. PHY chips allow other channel layer chips, called MACs, to connect to the physical transmission medium, such as optical fiber or copper cable. That is, in Linux, the PHY is the number assigned to the device by the PHY driver/framework to refer to and configure at the channel level. As for dev (device name, interface name), this is a conventional name assigned to the device by the system. There are different naming schemes, network interfaces may be named differently in different Linux distributions. If desired, the name of the network interface can be changed.

It would seem, but so what? Through phy, you can control parameters, the meaning of which is unclear without reading special technical documentation. Through the name of the dev interface, you can control more familiar settings (switch to monitor mode, switch to a certain channel, and so on). The fact is that for wireless adapters, the network interface is not just a name that identifies the device. There are different types of interfaces and to access some wireless adapter capabilities you need to add interfaces. Moreover, one Wi-Fi adapter can have several network interfaces performing different functions at once, for example, a combination of interfaces in managed mode and monitor mode, or a combination of interfaces in managed mode and access point mode, while the wireless adapter will simultaneously perform two functions at once! Moreover, different interfaces of the same Wi-Fi adapter can be given different MAC addresses.

Run the following command to list the full capabilities of all wireless interfacesiw list:

Search for the following lines:

• software interface modes (can always be added) — software modes of interfaces (can always be added)

• valid interface combinations – combinations of interfaces are possible

An example of the first Wi-Fi adapter:

That is, instead of switching the interface from managed mode to monitor mode or running an access point on it, you can add a virtual interface in monitor mode or AP mode to the existing one. Also, this wireless adapter can have up to two network interfaces in managed, P2P-client modes, up to two AP, mesh point, P2P-GO interfaces, but in any case the total number of interfaces cannot be more than two, while in they must all have one channel (#channels <= 1).

The following example:

Again, you can add an interface in monitor mode, there can only be one interface in managed mode, there can be up to three interfaces in total and they can use up to two different channels (#channels <= 2). You can also add up to four AP interfaces. Sometimes you can make up to 8 AP interfaces, but they can use a single channel.

Add or remove an interface in monitor mode

The preferred way to get monitor mode is to switch the existing wireless interface from managed mode to monitor mode:

As a result, the Wi-Fi card, while it is in monitor mode, loses the ability to connect to access points, that is, there is no Internet connection. By adding a new interface, this problem can be solved. Adding an interface in monitor mode is performed as follows:

As INTERFACE specify the name of an existing interface, and as NEW_INTERFACE you can specify an arbitrary name.

If desired, you can assign an arbitrary MAC address to the new interface:

Let’s see what wireless interfaces are available in the iw dev system:

We see that the Wi-Fi card wlp0s20f0u1 is connected to the network named Jenechka (Screenshot 3).

Let’s add to wlp0s20f0u1 an interface with the name wlanmon in monitor mode and set the MAC address on it:

Let’s look again at our iw dev interfaces:

Note that a new wlanmon interface has appeared. Let’s run airodump-ng using the newly created virtual interface:

And in another window, let’s run a ping to make sure that the network connection is still available (Screenshot 5):

Please note that despite the fact that the Wi-Fi adapter needs to be on one channel to communicate with the TV, the interface in monitor mode switches channels.

Moreover, even after stopping screen recording, airodump-ng even managed to catch a handshake (Screenshot 6). I have not noticed that the virtual interface in monitor mode, when used for data capture, interferes with the Internet connection. But if you try to send something from it (for example, to deauthenticate wireless clients), the Internet connection breaks. Most likely, this is due to a change in the channel in use.

To remove a virtual interface, use the command:

Example:

Types of virtual interfaces

An example of a command in which the name of the network interface was specified:

You can also add a virtual interface named PHY:

This may be useful if you have removed all existing interfaces (if possible). Available interface types:

• managed

• ibss

• monitor

• mesh

• wds

Flags are used only for monitor interfaces, valid flags:

mesh_id is only used for mesh mode. There is no AP in the list of valid interface types. This AP type interface will be created automatically when the access point is created.

Using:

For example, on the interface wlo1, I want to create a TD with the name HackWare and the password 12345678, the interface wlp0s20f0u1 (Screenshot 7) should be used as the source of the Internet, then the command is as follows:

I can connect to this TV and use the Internet (Screenshot 8):

A new AP interface named ap0 was created on the computer (Screenshot 9):

Using one Wi-Fi card as a client and as an access point

The method shown above implies that you have two network interfaces – and one of them must be a Wi-Fi adapter, and the second can be both a Wi-Fi adapter and a wired connection. Let’s say I don’t have a wired connection and only have one adapter, is it possible to use one Wi-Fi card to connect to an access point and as an access point at the same time? You can. One network interface can simultaneously work as a client and as a TD, that is, it can act as a signal amplifier (wireless repeater). Let’s start by stopping NetworkManager, otherwise in my case I kept getting the error RTNETLINK answers: Device or resource busy:

If you have NetworkManager removed from autoboot, you need to start by activating the wireless interface:

Now we need to create two virtual interfaces in managed mode with different MAC addresses (Screenshot 10):

One of these interfaces will act as a station, and the other as a TD. Since we disabled NetworkManager, we now need to connect to the remote TV manually.

We create a configuration file:

wpa_passphrase Jenechka PASSWORD > wpa_Jenechka.conf

We connect:

If you want the wpa_supplicant process to go into the background, add the -B option:

Connection takes some time:

# sleep 5 # if you run it through a script, then at this point you need to give time for connection

We start the DHCP service to automatically obtain an IP address:

We look at the state of iw dev interfaces:

We see that the wlan0_sta interface is connected to the TD, which is exactly what we need. It is very important – look at which channel the TD and the client are working on. This channel must be specified in the next command, otherwise nothing will work. In this case, they work on channel 8.

Finally, we launch TD with the name HackWare and password 12345678 on channel 8:

Commands for displaying network interface names

Show only iw dev wireless interfaces:

Outputting some hardware information:

Names and description of interfaces:

Output of wireless interfaces along with their PHY, driver and chipset information:

The conclusion of everything that resembles network interfaces (along with virtual ones):

You can view the interface and hardware names as follows:

This is how you can display the names of interfaces, except for virtual ones:

Statistics by interfaces can be viewed as follows: