How to capture all Wifi SCAN/MLME events on Android using nl80211.h?

Question

I am trying to write a simple native app on Android to capture all Wifi related Events through Netlink MLME and SCAN events(especially I need Wifi Scan, Association, DisAssociation, Authentication, DeAuthentication, Roaming, etc.. events).

I developed a native app and push it to device(/system/bin) using adb and run as root. However, I ONLY get CONNECT/DISCONNECT events when i turn wifi ON/OFF. I DO NOT get any other events like: SCAN_TRIGGER, SCAN_RESULTS, (DIS)ASSOCIATION, (DE)AUTHENTICATION, ROAMING and etc...

I have shared the code Below. Can you pls help me to fix the issue(if any) so that it can work for all Wifi events? Thanks in Advance!

#include <netlink/netlink.h>
#include <netlink/attr.h>
#include <netlink/genl/genl.h>
#include <netlink/genl/ctrl.h>
#include <net/if.h>
#include <signal.h>
#include <stdint.h>
#include <linux/nl80211.h>

#define print_err(...) fprintf(stderr, __VA_ARGS__)

static struct nl_sock *sk = NULL;

static int nlCallback(struct nl_msg* msg, void* arg)
{
printf("\n\t nlCallback Start\n");
struct nlmsghdr* ret_hdr = nlmsg_hdr(msg);
struct genlmsghdr *gnlh = nlmsg_data(ret_hdr);

printf("nlCallback: Event Commmand: %d\n", gnlh->cmd);

switch(gnlh->cmd) {
    case NL80211_CMD_TRIGGER_SCAN :
        printf("nlCallback: cmd: NL80211_CMD_TRIGGER_SCAN \n");
        break;
    case NL80211_CMD_SCAN_ABORTED : 
        printf("nlCallback: cmd: NL80211_CMD_SCAN_ABORTED \n");
        break;
    case NL80211_CMD_NEW_SCAN_RESULTS :
        printf("nlCallback: cmd: NL80211_CMD_NEW_SCAN_RESULTS \n");
        break;
    case NL80211_CMD_CONNECT :
        printf("nlCallback: cmd: NL80211_CMD_CONNECT \n");
        break;
    case NL80211_CMD_DISCONNECT :
        printf("nlCallback: cmd: NL80211_CMD_DISCONNECT \n");
        break;
    case NL80211_CMD_NEW_STATION:
        printf("nlCallback: cmd: NL80211_CMD_NEW_STATION \n");
        break;
    case NL80211_CMD_DEL_STATION:
        printf("nlCallback: cmd: NL80211_CMD_DEL_STATION\n");
        break;
    case NL80211_CMD_AUTHENTICATE:
        printf("nlCallback: cmd: NL80211_CMD_AUTHENTICATE\n");
        break;
    case NL80211_CMD_DEAUTHENTICATE:
        printf("nlCallback: cmd: NL80211_CMD_DEAUTHENTICATE\n");
        break;
    case NL80211_CMD_ASSOCIATE:
        printf("nlCallback: cmd: NL80211_CMD_ASSOCIATE\n");
        break;
    case NL80211_CMD_DISASSOCIATE:
        printf("nlCallback: cmd: NL80211_CMD_DISASSOCIATE\n");
        break;
    case NL80211_CMD_ROAM:
        printf("nlCallback: cmd: NL80211_CMD_ROAM\n");
        break;
    default:
        printf("nlCallback: Default multicast event: %d\n", gnlh->cmd);
        return NL_SKIP;
    }

return 0;
}

static int cleanup_and_exit(int ret)
{
if (sk != NULL)
    nl_socket_free(sk);
exit(ret);
}

static void signal_handler(int sig)
{
cleanup_and_exit(EXIT_SUCCESS);
}

int main()
{
printf("\n\t ****** main() Start *******\n");
int ret;
int sk_fd;
fd_set rfds;

signal(SIGTERM, signal_handler);
signal(SIGINT, signal_handler);

sk = nl_socket_alloc();
if (sk == NULL) {
    print_err(" main(): ERROR : Unable to allocate Netlink socket\n");
    exit(EXIT_FAILURE);
}

ret = genl_connect(sk);
if (ret < 0) {
    print_err(" main(): ERROR : no connect %d\n", ret);
    cleanup_and_exit(EXIT_FAILURE);
}

int mc_grp1 = genl_ctrl_resolve_grp(sk, "nl80211", "mlme");// will return 5.
if (mc_grp1 < 0) {
    print_err("main(): ERROR : MLME group not found : %d\n", mc_grp1);
    cleanup_and_exit(EXIT_FAILURE);
}

int mc_grp2 = genl_ctrl_resolve_grp(sk, "nl80211", "scan");// will return 3.
if (mc_grp2 < 0) {
    print_err("main(): ERROR : SCAN group not found : %d\n", mc_grp2);
    cleanup_and_exit(EXIT_FAILURE);
}

printf("\n\t main() Subcribed group ids:: MLME: %d, SCAN: %d\n", mc_grp1, mc_grp2);
ret = nl_socket_add_memberships(sk, mc_grp1, mc_grp2, 0);
if (ret < 0) {
    print_err("main(): ERROR : Unable to join multicast group %d\n", ret);
    cleanup_and_exit(EXIT_FAILURE);
}

nl_socket_disable_seq_check(sk);
ret = nl_socket_modify_cb(sk, NL_CB_VALID, NL_CB_CUSTOM, nlCallback, NULL);
if (ret < 0) {
    print_err(" main(): ERROR : Unable to register callback %d\n", ret);
    cleanup_and_exit(EXIT_FAILURE);
}

while (1) {
    printf("\nmain(): While(1): Waiting for MLME/SCAN events \n");
    ret = nl_recvmsgs_default(sk);
    if (ret < 0) {
        cleanup_and_exit(EXIT_FAILURE);
    }
    printf("main(): While(1): MLME/SCAN event received: %d \n", ret);
}

printf("\n\t ****** main() End *******\n");
cleanup_and_exit(EXIT_FAILURE);
}

score 0 · Answer 1 · answered Oct 14 '21 at 03:39

Depending on the wifi driver's capabilities, it may send up different sets of NL80211 messages to the userspace. I think you can cross check the result by using the "iw" command, for example:

iw event -f

See: https://wireless.wiki.kernel.org/en/users/documentation/iw You may need to build the iw onto your target system.

How to capture all Wifi SCAN/MLME events on Android using nl80211.h?

1 Answers1