Asus RT-AC86U: Installing Nexmon_csi

[zeroby0]

Welcome to the Nexmon_csi installation guide for Asus RT-AC86U!

We use pre-built binaries in this guide to make the installation fast and easy. A guide to building the binaries from source is available here #7.

Recommended: Install Asus Merlin-WRT version 384.19_0 on you rt-ac86U

Installation

1. Download and extract nexmonster-rtac86u.zip.
2. Copy the contents to the /jffs/ partition of your router: scp ./nexmonster-rtac86u/* admin@<routers-ip>:/jffs/
3. Make nexutil, makecsiparams, and tcpdump executable: ssh admin@<routers-ip> "/bin/chmod +x /jffs/nexutil /jffs/mcp /jffs/tcpdump "

Aand that's it! 🥳

Testing

1. Reload router firmware:

/sbin/rmmod dhd
/sbin/insmod /jffs/dhd.ko

2. Bring up interfaces:

wl -i eth6 up
wl -i eth6 radio on
wl -i eth6 country US
ifconfig eth6 up

3. Start CSI collection

/jffs/mcp -c 36/80 -C 1 -N 1
/jffs/nexutil -Ieth6 -s500 -b -l34 -vKuABEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
/usr/sbin/wl -i eth6 monitor 1

Collect CSI with TCPdump

/jffs/tcpdump -i eth6 dst port 5500

Important: While using TCPdump, the pcap files should always be saved to an external drive. Saving pcap files to the router's file-system will wear out the flash storage and damage your router.

Persistence

dhd.ko has to be manually reloaded, and the interfaces have to be brought up everytime you reboot the router. There is a way to automate this, if you're using Asus Merlin-WRT.

1. Enable user scripts in the router's web interface: Advanced > Administration > System > Persistent JFFS2 partition > Enable user scripts
2. Create a startup script file: touch /jffs/scripts/services-start
3. Add the following content to the file we just created.

#!/bin/sh

/sbin/rmmod dhd
/sbin/insmod /jffs/dhd.ko

wl -i eth6 up
wl -i eth6 radio on
wl -i eth6 country US
ifconfig eth6 up

echo "services-start: Nexmon Setup Complete" > /dev/kmsg

4. Make the script executable: chmod a+rx /jffs/scripts/services-start

That is all. Reboot and check if our script ran with dmesg | grep "services-start". You won't need to reload router's firmware or bring up the interfaces from now on.

2.4 GHz Channels

When using 2.4 GHz channels, use eth5 instead of eth6 in all of the steps above.

RT-AC86U uses eth6 interface for 5 GHz, and eth5 for 2.4 GHz. (Thanks @liyenjie33 and @jlinktu!)

[tweigel-dev]

@zeroby0 what did you think about a github actions pipeline which builds the dhd.ko automatically and expose it?
I'am experienced with gitlab CI but I think Github Actions is simular.

[zeroby0]

Cool idea! It will be super useful when we start adding more metrics to the rt-ac86u! Can you look into implementing it?

Here is my notepad for building from source: install.txt. I will make a discussions guide on it soon, but this may come in help till then.

[yujianyuanhaha]

@zeroby0 awesome job!
May I know what the mcp command is for? Best

[zeroby0]

Thanks! mcp is makecsiparams, but renamed so it's faster to type :)

[zeroby0]

Guide to building Nexmon_CSI from sources is finally available here: #7!

You should only need it if you plan to modify Nexmon_CSI. This pre-built binaries in this guide are made with instructions in #7. We can make a Github Codespace / Actions pipeline to build Nexmon_CSI if there is demand for it, let me know :)

[ShivamJoshi64]

Thanks, @zeroby0
This is really helpful!

I have a question regarding enabling user scripts. I do not see a 'Persistent JFFS2 partition' section in the Administration > System page of the router web UI. Can you please tell me why this could be the case?

[zeroby0]

Hey Shivam, persistent JFFS2 is only available on Merlin WRT as far as I remember. So maybe that's why?

[itaysaadia]

Thanks a lot for the guide! it is extremely helpful

for some reason, every time I load the module (dhd.ko) the WiFi LEDs on the router are dimmed (but not turned off completely) and I can't see or connect to the WiFi network of the router anymore

I am using Merlin Firmware Version:384.19 (the same one you recommended on post 7) and used your pre-compiled binaries.

when I am starting the sniffing with the filter KuABEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA (/jffs/mcp -c 36/80 -C 1 -N 1) it does capturing packets, but evey time I try to filter it to my phone's MAC address tcpdump does not capture any packets.
It makes sense, because the router may not recognize my phone while it is not connected to its network.

do you know to so solve the problem? it seems like a WiFi issue and not nexutil / filtering issue, but i am not sure.

[zeroby0]

Thanks :)

It makes sense, because the router may not recognize my phone while it is not connected to its network.

This is correct. You need to connect the phone to another routers WiFi network so that it sends packets.

[Cyrbaby]

@zeroby0，thanks for the guide！ It is really helpful！
May I ask how can I save the pcap files in an external drive rather than router's file-system？ Even if I plugged a USB drive into my router, I couldn't find the external folder

[zeroby0]

I don't know where the router mounts the USB exactly either. But I think you can mount it like a normal block device..

That said, it would probably be better to redirect the packets to your computer and save it on your computer. The USB link is slow, and the processor is weak, so saving it there will result in less packets per second. If I find the time and motivation, I'll write a guide on forwarding packets, but right now Google is your best friend: https://www.google.com/search?q=linux+forward+packets+to+ip :)

[GerbenGheysens]

@zeroby0 Where are the pcap files stored on the router?

[zeroby0]

@GerbenGheysens pcap files should never be stored on the router, the flash storage is small, and wears out easily if you write onto it.

Instead, you should plug in a USB drive into the port on the back, mount it, and use tcpdump to write into the USB drive.

[Cyrbaby]

@zeroby0，thank you for your guide！I use “df -h” then I can find the location the USB drive mounted on the router.

[GerbenGheysens]

when executing
/jffs/nexutil -Ieth6 -s500 -b -l34 -vkuABEQAAAA....
I got __nex_driver_io: error ret=-1 errno=95 as error. Has anyone an idea what this error mean and how it can be solved?

[zeroby0]

Do you still get this error? It might be because of using the wrong interface, although I think eth6 is right.

[GerbenGheysens]

Yes, sometimes I get this error and when I do the installation from zero, it works again...

[zeroby0]

That's weird. It should be enough to reboot the router.
Did you do the persistence section? If you did, rebooting the router is same as re-installing Nexmon_csi.

[GerbenGheysens]

No not yet, but I think its a good idea to do the persistence section...

[zeroby0]

Yeah. I'm fairly certain this error happens when the modified Nexmon_csi firmware is not loaded into the kernel.
You can verify whether the firmware is loaded or not by running /jffs/nexutil -Ieth6 -V. The first line should contain 10.10.122.20 (nexmon.org/csi) if it loaded properly.

seemoo-lab#179 (comment)

[niloobah]

I am following instruction on #7
ssh admin@ "/bin/chmod +x /jffs/nexutil" , I get this error: X11 forwarding request failed on channel 0
Anyone had this problem or know the solution? Thank you for your help

[zeroby0]

ssh into the router, then run /bin/chmod +x /jffs/nexutil and then exit ssh and proceed?

[niloobah]

Thanks a lot. Btw, did you get a chance to update the saving process? I couldn't figure out how to save the collected data.

[zeroby0]

#2 (comment)

Run df -h after you connect a USB drive to find it's mount point and save into it with tcpdump.

[wolke1526]

Greatings
thanks for the work! it's very helpful !
may I ask how the CSI collection is related with the channel number? at the begining I setup the router and I can collect some CSI data, but after I apply some setting to the Tx router (change the channel number to auto), the packets collected is significantly less than before, and when I turn the channel to a specific number (like 36), it back to normal, could you please tell me about this?
Also I am still confusing that the CSI collected is the CSI between the ac86u(monitor) and the Tx router? or CSI between the other device (like a laptop, phone, that communicate with Tx) and the Tx router? or 2 devices that communicate though the Tx router so the ac86u just over hearing the link? I read some paper and the issue of the Nexmon and found the differences, much appreciate if you could explain this to me as well!

[wolke1526]

my configuration is : a wifi router connect with internet via ethernet cable, WAN port of ac86u connects with LAN port of wifi router via ethernet cable, ac86u controlled by a ubuntu desktop via ethernet, and a laptop and phone communicate with the wifi router, but can't really understand CSI of which link is collected in my case.

[zeroby0]

CSI is collected only in the channel specified by makecsiparams (abbreviated as mcp in this repo). The listening router makes no distinction between where the packet is coming from, or going, it just collects the CSI of all routers. If you pass a mac id to filter by, the firmware allows csi only from packets coming from that CSI, rest are skipped..

When your router is set to auto, it's probably transmitting in some other channel, not in 36. While the ac86u is listening in channel 36, so it can't hear the router. The CSI you're getting is some random traffic from other routers and devices.

If you wanna learn more, skim through all of the issues in the nexmon_csi repo, and read the paper. I'd highly recommend you do that if you're planning to use nexmon_csi.

https://en.wikipedia.org/wiki/List_of_WLAN_channels
https://en.wikipedia.org/wiki/802.11_Frame_Types

[GerbenGheysens]

When I collected some CSI data (4x4) from my RT-AC86U, I only got one vector in the matlab script. How can I distinguish which data is coming from which antenna?

[zeroby0]

Linking to the issue on seemoo-lab/nexmon_csi for posterity: seemoo-lab#226 :)

[noodddyyyy]

Thanks for the work. They are really convinient to use. I wonder if it is possible to upload a latest version of the compiled tools. The latest version seemed to have added RSSI field in the CSI frame.
I have tried to follow #7, to build it myself. But unfortunately, even though I can successfully build everything, but the CSI frame seemed to be a bit strange. The first three uint32 of CSI data (out of 256, in 80MHz case I tested) never change. Even for an empty CSI frame, the first three unit32 are not "20 00 00 00".

[zeroby0]

I'll try to! :D

The latest version seemed to have added RSSI field in the CSI frame.

Thanks for the reminder! I forgot about that.

Hopefully I'll have them compiled by mid April -- my ac86u is in use as a router, so it'll take some work to take it out.
I'm not aware of the CSI frame strangeness, but I'll take a look when I compile it.

[noodddyyyy]

Thanks.

[noodddyyyy]

Actully I checkout the nexmon and nexmon-csi repos with the states before Dec 2020 (it was when you uploaded the binaries), compied myself and it worked well. So now I wonder whether it is a bug introduced in the later commits.

[zeroby0]

Update: My RT-AC86U stopped working after lightning strikes near my home last night. So I won't be able to provide newer pre-compiled binaries anymore.

You can compile binaries from source following #7. Please post the binaries you compiled here so others can use them.

If you're willing to sponsor me an ac86u, please contact me (aravind.reddy@iiitb.org).

Good luck.

[Gs-Smit]

Why does the router disconnect and fail to connect every time I run/sbin/rmmod dhd?