proberelay

A simple program that relays WiFi probe requests collected on a monitor mode interface to another host over UDP.

Usage

Usage: bin/proberelay [OPTIONS] ...

  -i IFNAME                         name of capture interface (required)
  -d HOST                           host to send probes to (required)
  -p PORT                           port to send probes to (default: 26737)
  -x SSID                           ssid to ignore (multiple allowed)
  -r SIGNAL                         minimum signal strength (-127 to 255)
  -t kernel|system|coarse|none      timestamp type (default: kernel)

For example:

proberelay -i mon0 -d 192.0.2.7 -r -80 -x tsunami -x 'Free Public WiFi'

The network interface must be in monitor mode.

Filtering

The socket filter looks for non-broadcast probe requests, and if possible, requires a valid frame checksum. This filter is generated at runtime by examining the first packet for a radiotap header, and parsing it. If there is no radiotap header, the filter will not validate frame checksums or be able to check signal strength.

SSID Exclusion

Does what it says on the tin. This is done in userspace.

Minimum Signal Strength

Radiotap has two fields for signal strength, one in standard dBm, and one in dB difference from “an arbitrary, fixed reference”. Negative values will be compared against dBm, zero or positive ones will be compared against dB.

Timestamping

Four modes are available:

• kernel - uses software receive timestamps generated by the kernel
• system - gets the system wall clock time in userspace
• coarse - low resolution system time, see docs for clock_gettime
• none - timestamp field will be set to zero

Features

• Packets flagged as having bad frame check sequence are dropped.
• Optimized capture filter using fixed offsets generated at run time.
• Root is dropped.

Packet Format

Each UDP payload can be treated as the contents of a pcap file containing a single packet.

Motivation

Amazon’s Dash Buttons have been discontinued and the official tools to set them up no longer work. Despite that, they can be useful for home automation if hacked.

These devices seem to use the least amount of power per activation if they are not allowed to connect to WiFi at all, but this complicates detecting them.

This program is intended to be run on wireless routers and/or access points, where it will forward probe requests generated by devices like the buttons on for further processing.

Help

This software has been released with the hope that it may be useful. Please feel free to file bug reports, but issues requesting new features or support will likely be closed without response.

TODO

• Automatically set snaplen based on PMTU.

WONTFIX

• Support for platforms other than Linux.

Author

Ryan Castellucci @ryancdotorg

License

This tool uses the three clause BSD license. Other licenses may be available by request. As a courtesy, please contact the author if you use this in a product.