Vivek Ramachandran,Thomas d'Otreppe - Make a 802.11AC Monitor

### The Scalability Crisis in Gigabit Wi-Fi Sniffing At 00:00, Vivek Ramachandran and Thomas d'Otreppe (lead author of the Aircrack-ng suite) open this advanced workshop in the Packet Hacking Village by addressing the obsolescence of traditional wireless penetration testing hardware. For over a decade, researchers relied on portable USB Wi-Fi dongles (such as Alfa cards with Atheros AR9271 chipsets). However, the rise of 802.11ac (Wi-Fi 5) renders USB 2.0 adapters completely incapable of monitoring multi-gigabit wireless traffic.

### Architectural Complexities of 802.11ac VHT Networks At 08:30 and 16:15, the speakers analyze the physical and MAC layer innovations that make 802.11ac difficult to audit. Very High Throughput (VHT) networks utilize wide channel allocations (up to 80 MHz and 160 MHz), complex 256-QAM modulation, and Multi-User Multiple-Input Multiple-Output (MU-MIMO) beamforming. Capturing these signals requires immense radio receiver bandwidth, sophisticated radio frequency front-ends, and high-throughput bus interfaces to prevent massive packet drop rates.

### Building a High-Performance 802.11ac Monitoring Appliance At 23:45 and 30:21, the presenters walk through assembling an affordable, enterprise-grade 802.11ac monitoring rig. Rather than waiting for functional USB 3.0 adapters, they recommend utilizing mini-PCIe or PCIe cards equipped with Qualcomm Atheros QCA9880 or Intel 7260 chipsets mounted onto single-board computers or laptop PCIe slots. They discuss driver architectures, detailing how the open-source `ath10k` driver and Linux `mac80211` subsystem handle 802.11ac frame aggregation (A-MPDU and A-MSDU).

### Driver Patching, Monitor Mode, and Packet Injection At 38:50 and 46:30, Thomas d'Otreppe demonstrates patching driver source code to enable true monitor mode and raw frame injection across 5 GHz channels. He explains common pitfalls, such as driver firmware crashing when exposed to malformed Radiotap headers or failing to capture VHT management frames. Participants are guided through compiling modified kernel modules, verifying monitor mode via `iw`, and executing packet captures in Wireshark.

### Advanced Wireless Auditing: Unusual Channel Widths and MU-MIMO Concluding between 52:10 and 59:19, the speakers demonstrate capturing aggregated wireless frames across non-standard channel widths (including 5, 10, and 80 MHz channels). They showcase Aircrack-ng interoperability with high-speed captures, demonstrating how analysts can reliably capture WPA2/WPA3 four-way handshakes and perform real-time protocol analysis in dense, modern 5 GHz enterprise wireless deployments.

(AI summary — Gemini 3.8 Flash)