AWUS036AXML (mt7961) - active monitor mode is broken

[yeyyyh]

Hey! I have AWUS036AXML adapter with active monitor mode (using mt7921u and loading WIFI_RAM_CODE_MT7961_1.bin and WIFI_MT7961_patch_mcu_1_2_hdr.bin drivers).

$sudo hcxdumptool -i wlan0 -w dumpfile.pcapng --rds=1 -F

Is it possible that launch of hcxdumptool switches my card to wrong monitor mode or breaks something? I've noticed that when I try:

$ sudo iw dev wlan0 set monitor active

the injection stops working ($ aireplay wlan0 --test, airodump-ng as well).

It only works with:
$sudo iw wlan0 set monitor control
I am of course stopping all services: sudo systemctl stop NetworkManager.service && sudo systemctl stop wpa_supplicant.service

The thing is that I managed to use hxcdumptool several times sometimes it was working fine, sometimes it showed only short list of APs and sometimes it didn't show any APs. I deleted my VM (yes, I know I shouldn't use it, but I managed to make it work before - just don't remember how).
I do not get any error, just screen is empty.

$lsb_release -a:
No LSB modules are available.
Distributor ID: Kali
Description: Kali GNU/Linux Rolling
Release: 2023.3
Codename: kali-rolling

$lsusb:
Bus 003 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 002 Device 002: ID 0e8d:7961 MediaTek Inc. Wireless_Device
Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 002: ID 0627:0001 Adomax Technology Co., Ltd QEMU Tablet
Bus 001 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub

$hcxdumptool -L:

available wlan devices:

1 4 xxx xxxx * wlan0 mt7921u (NETLINK)

• active monitor mode available

• monitor mode available

• no monitor mode available

$dmesg output also looks fine:

[ 106.006694] warning: `iwconfig' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[ 227.450167] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[ 227.451133] mt7921u 2-1:1.3 wlan0: entered promiscuous mode
[ 237.945383] mt7921u 2-1:1.3 wlan0: left promiscuous mode
[ 261.599185] mt7921u 2-1:1.3 wlan0: entered promiscuous mode
[ 277.484889] mt7921u 2-1:1.3 wlan0: left promiscuous mode
[ 284.619487] mt7921u 2-1:1.3 wlan0: entered promiscuous mode
[ 284.619490] mt7921u 2-1:1.3 wlan0: entered allmulticast mode
[ 483.723850] mt7921u 2-1:1.3 wlan0: left promiscuous mode
[ 483.723854] mt7921u 2-1:1.3 wlan0: left allmulticast mode
[ 484.166318] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[ 484.183379] mt7921u 2-1:1.3 wlan0: entered promiscuous mode
[ 484.221194] mt7921u 2-1:1.3 wlan0: entered allmulticast mode
[ 532.645132] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[ 845.711958] usbcore: deregistering interface driver mt7921u
[ 851.584877] mt7921u 2-1:1.3: firmware: direct-loading firmware mediatek/WIFI_RAM_CODE_MT7961_1.bin
[ 852.010569] usb 2-1: reset high-speed USB device number 2 using xhci_hcd
[ 852.236755] bluetooth hci0: firmware: direct-loading firmware mediatek/BT_RAM_CODE_MT7961_1_2_hdr.bin
[ 852.304839] usbcore: registered new interface driver mt7921u
[ 852.306473] mt7921u 2-1:1.3: firmware: direct-loading firmware mediatek/WIFI_MT7961_patch_mcu_1_2_hdr.bin
[ 852.306493] mt7921u 2-1:1.3: HW/SW Version: 0x8a108a10, Build Time: 20230331110902a

[ 852.321584] mt7921u 2-1:1.3: firmware: direct-loading firmware mediatek/WIFI_RAM_CODE_MT7961_1.bin
[ 852.321590] mt7921u 2-1:1.3: WM Firmware Version: ____010000, Build Time: 20230331110939
[ 852.394170] Bluetooth: hci0: Device setup in 165098 usecs
[ 852.394174] Bluetooth: hci0: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported.
[ 946.828153] mt7921u 2-1:1.3 wlan0: entered promiscuous mode
[ 960.397742] mt7921u 2-1:1.3 wlan0: left promiscuous mode
[ 977.828080] mt7921u 2-1:1.3 wlan0: entered promiscuous mode
[ 977.828084] mt7921u 2-1:1.3 wlan0: entered allmulticast mode

[yeyyyh]

One more important thing- after setting down wlan0, activating monitor control and setting it up, airodump-ng works.
Later, I am launching hxcdumptool (doesn't work) and when I try to launch airodump or aireplay wlan0 --test, none of them are working. I need to again set down wlan0, activate monitor control and set it up, to get airodump working.

[ZerBea]

The driver stops working if the first packet is injected.

[ZerBea]

Activve monitor mode is not working as expected on mt7921u and 7601u. Both problems are reported to upstream:
https://bugzilla.kernel.org/show_bug.cgi?id=217465
openwrt/mt76#839
morrownr/USB-WiFi#107

and hcxdumptool received a workaround (changelog):

08.12.2023
==========
Some drivers report incorrectly active monitor mode capability.
hcxdumptool: do not set active monitor mode by default if driver report that it is possible
             removed option -p
             added new option -A in case active monitor mode is working as expected
             -A             : ACK incoming frames
                               INTERFACE must support active monitor mode

Even if the driver report that active monitor mode is possible, hcxdumptool will not use it by default any longer.
Active monitor mode must now be confirmed with -A option.
That should fix the problem.

[yeyyyh]

Thanks a lot man! Indeed, updated hcxdumptools do not cause the issue anymore. Although, do you know when can we expect the fix for the driver to be able to use the active monitor mode?

Also, I cannot find the right comparison. Do you think ‎AWUS036ACH-C with the realtek chipset (as far as I saw it has better range) would be a better option than AWUS036AXML? ‎AWUS036ACH-C doesn't support active monitor mode, right?

Also one more question, does overwriting wireless regulatory base improve anything? or this is just cosmetic change?

[ZerBea]

The driver for the ALFA AWUS036ACH is not part of the Linux stock kernel. As of today, it is mandatory to install a third party driver.
The settings of the wireless regulatory domain are important. The regulatory domain is used to reconfigure wireless drivers to make sure that wireless hardware usage complies with local laws set by the FCC, ETSI and other organizations.
Channel usage and TX power is allowed or disallowed by this settings.
Active monitor mode is a nice to have in case of PMKID attacks, but it is not mandatory.

[yeyyyh]

Thanks a lot! Really helpful :)