Actions
Forum Thread Details
  • State Not Answered
  • Replies 11 replies
  • Subscribers 493 subscribers
  • Views 1315 views
  • Users 0 members are here
Related

Request for Help with Implementing MAC Filter on ESP8266 in AP Mode using Arduino Platform(PlatformIO)

SajjadQadri

Hello Everybody,

I am working on a project using the ESP8266 and need to implement a MAC filter in Access Point (AP) mode. I am using the Arduino platform(PlatformIO) for programming and require your assistance.

My main issue is how to define a list of allowed MAC addresses and disconnect a client if its MAC address is not on the allowed list.

I have tried several different codes so far, but it seems that some of these codes do not work correctly. For example, the code that was previously suggested to me:
void wifi_station_deauth(uint8_t *bssid) {
struct auth_deauth_frame {
uint16_t frame_control;
uint16_t duration;
uint8_t da[6];
uint8_t sa[6];
uint8_t bssid[6];
uint16_t seq_ctrl;
uint16_t reason_code;
} __attribute__((packed));

struct auth_deauth_frame frame;
frame.frame_control = 0x00C0;
frame.duration = 0;
memcpy(frame.da, bssid, 6);
memcpy(frame.sa, WiFi.softAPmacAddress().c_str(), 6);
memcpy(frame.bssid, WiFi.softAPmacAddress().c_str(), 6);
frame.seq_ctrl = 0;
frame.reason_code = 0x0001; // Unspecified reason

wifi_send_pkt_freedom((uint8_t *)&frame, sizeof(frame), 0);
}

This code does not disconnect clients whose MAC addresses are not on the allowed list. I have been using standard Arduino library functions as well as lower-level SDK functions, but I have not been able to resolve the issue.

Has anyone had a similar experience or can provide a comprehensive guide for creating an effective MAC filter on the ESP8266? Any sample code or suggestions in this regard would be greatly appreciated.

Thank you in advance for your help and guidance.

Best regards,
Sajjad Qadri

  • 0

    You need to write more code. What you've posted simply constructs a packet and sends it. You still need to write the code that searches your list and determines if that packet needs to be sent or not.

  • 0 in reply to shabaz
    Hello, dear shabaz
    My whole project is:

    #include     <Arduino.h>
    #include "ESP8266WiFi.h"

    extern "C" {
      #include "user_interface.h"
    }

    #define none        0
    #define upperCase   1
    #define lowerCase   2

    #define apSSID      "AP_SSID"
    #define apPass      "AP_Pass"

    String myAPmac;
    IPAddress apAip(192, 168, 10, 1);
    IPAddress apGw(192, 168, 10, 1);
    IPAddress apSub(255, 255, 255, 0);
    void whenAPRecievedRequest(const WiFiEventSoftAPModeProbeRequestReceived &evt);
    void wifi_station_deauth(uint8_t *bssid);
    uint8_t *stringToMac(String macstr);
    String macToString(const uint8_t *bssid, uint8_t letter_style);
    void setup()
    {
      WiFi.softAP(apSSID, apSSID);
      WiFi.softAPConfig(apAip, apGw, apSub);
      WiFiEventHandler request = WiFi.onSoftAPModeProbeRequestReceived(&whenAPRecievedRequest);
      myAPmac = WiFi.softAPmacAddress();
    }

    void loop()
    {

    }
    void whenAPRecievedRequest(const WiFiEventSoftAPModeProbeRequestReceived &evt)
    {
      String newMac = macToString(evt.mac, upperCase);
      uint8_t mac[6];
      memcpy(mac, evt.mac, 6);
      if (newMac != "AA:BB:CC:DD:EE:FF")
        wifi_station_deauth(mac);
    }
    void wifi_station_deauth(uint8_t *bssid)
    {
      struct auth_deauth_frame
      {
          uint16_t frame_control;
          uint16_t duration;
          uint8_t da[6];
          uint8_t sa[6];
          uint8_t bssid[6];
          uint16_t seq_ctrl;
          uint16_t reason_code;
      } __attribute__((packed));

      struct auth_deauth_frame frame;

      frame.frame_control = 0x00C0;
      frame.duration = 0;
      memcpy(frame.da, bssid, 6);
     
      memcpy(frame.sa, stringToMac(myAPmac), 6);
      memcpy(frame.bssid, stringToMac(myAPmac), 6);
     
      frame.seq_ctrl = 0;
      frame.reason_code = 0x0001; // Unspecified reason

      wifi_send_pkt_freedom((uint8_t *)&frame, sizeof(frame), 0);
    }
    uint8_t *stringToMac(String macstr)
    {
      static uint8_t macAddr[6];  
      if (macstr.length() != 17)
      {
        memset(macAddr, 0, sizeof(macAddr));
        return macAddr;
      }
      for (int i = 0; i < 6; i++)
      {
        String byteStr = macstr.substring(i * 3, i * 3 + 2);
        macAddr[i] = (uint8_t) strtol(byteStr.c_str(), NULL, 16);
        if (i < 5 && macstr.charAt(i * 3 + 2) != ':') {
              memset(macAddr, 0, sizeof(macAddr));
              return macAddr;
        }
      }
      return macAddr;
    }
    String macToString(const uint8_t *bssid, uint8_t letter_style)
    {
      char buf[20];
      snprintf(buf, sizeof(buf), "%02x:%02x:%02x:%02x:%02x:%02x", bssid[0], bssid[1], bssid[2], bssid[3], bssid[4], bssid[5]);
      String output = String(buf);
      if (letter_style == lowerCase)
      {
          output.toLowerCase();          
      }
      else if (letter_style == upperCase)
      {
          output.toUpperCase();          
      }
      return output;
    }
  • 0 in reply to SajjadQadri

    Hard to follow the code (needs Insert->Code to be used to get it looking readable). However, I guess it looks approximately right, have you used the Serial.print functions to display the contents of the arriving MAC address to check that it matches the value that you are hard-coding? You need some way to confirm that it is being correctly matched, otherwise you can't tell where the issue in the code may be. A print statement to indicate if your wifi_station_deauth function is actually being reached and executed is needed.

  • 0 in reply to shabaz

    Hello, dear Shabaz
    And thank you for taking the time to answer me
    I checked what you said. The wifi_station_deauth function is executed, but the device that wants to connect to ASP 66 can still establish its connection. I think this should happen in a burst so that the client refuses to connect. Am I right?

  • 0 in reply to SajjadQadri

    You could try to print out the frame you're sending, just to double-check that it looks like what you expect. I have not used the ESP8266 for a long time (and never tried what you're trying) so I don't know the behavior of the function you're using.

    I also don't understand the use-case. If you're trying to prevent a denial of service attempt, then the ESP8266 is the wrong device. Even if your code was able to drop the connection attempt quickly, the ESP8266 is still consuming resources to do that. Clients could simply throw many connection attempts at it and it will probably fall over.

  • 0

    Hello! Did you check that deauth frames are really sent? Some git repos contain the following warning:
    Warning! This example runs with a particular SDK build that is now integrated into this project. Future versions of the esp_iot_sdk removed the ability to send wifi control frames with wifi_send_pkt_freedom.

  • 0 in reply to JWx

    Hello dear JWx
    Thank you for your reply
    When I check the WiFi traffic of my laptop with wireshark software, I don't see a package with the size of the package in the code, and I think that it is not being sent, but I also give the possibility that I can't work properly with wireshark software. Because it is the first time I use it.
    How can I track this package properly?
    How can I write this function that can interrupt the requesting client?
    please guide me
    Thanks
    Sajjad Qadri

  • 0 in reply to SajjadQadri

    Hello!

    one can switch wlan adapter into the monitor mode (but maybe not every one chipset possible) - below is more reference:
    wiki.wireshark.org/.../WLAN

  • 0 in reply to JWx

    there are some projects on github, using/inlcuding old ESP code that was still capable of sending deauth frames - maybe using this code would be needed... But some caution should be exercised not to disrupt legitimate traffic in the neighborhood if wrong frame is transmitted...