|
|
# $OpenBSD: hostapd.conf,v 1.11 2007/02/27 20:53:45 david Exp $
|
|
|
# sample hostapd configuration file
|
|
|
# see hostapd.conf(5)
|
|
|
|
|
|
# "wavelan is a battle field"
|
|
|
|
|
|
#
|
|
|
# Macros
|
|
|
#
|
|
|
|
|
|
# Define macros for the interfaces to be used by hostapd. The "wlan"
|
|
|
# interface is optional.
|
|
|
wlan="ath0"
|
|
|
wired="sis0"
|
|
|
|
|
|
#
|
|
|
# Tables
|
|
|
#
|
|
|
|
|
|
# Define the MAC addresses (BSSIDs) for your accesspoints in a table.
|
|
|
table <myess> {
|
|
|
00:90:4b:0d:fd:c8,
|
|
|
00:02:6f:21:ea:8b
|
|
|
}
|
|
|
|
|
|
# Address masks are providing a simple way to match by MAC vendor ID.
|
|
|
#
|
|
|
# table <senao> { 00:02:6f:ff:ff:ff & ff:ff:ff:00:00:00 }
|
|
|
|
|
|
#
|
|
|
# Global options
|
|
|
#
|
|
|
|
|
|
# Comment this option to run hostapd in passive IAPP logging mode.
|
|
|
set hostap interface $wlan
|
|
|
|
|
|
# Use default radiotap mode.
|
|
|
set hostap mode radiotap
|
|
|
|
|
|
# Uncomment these options to jump to the next channel every 2 seconds.
|
|
|
#set hostap hopper interface $wlan
|
|
|
#set hostap hopper delay 2000
|
|
|
|
|
|
# Use multicast (according to the revised standard).
|
|
|
set iapp interface $wired
|
|
|
set iapp mode multicast
|
|
|
|
|
|
# The following mode is compatible to some pre-standard IAPP implementations
|
|
|
#set iapp mode broadcast port 2313
|
|
|
|
|
|
#
|
|
|
# Event rules
|
|
|
#
|
|
|
|
|
|
# Log probe requests.
|
|
|
hostap handle type management subtype probe request \
|
|
|
with iapp type radiotap
|
|
|
|
|
|
# Log and annoy foreign accesspoints.
|
|
|
#
|
|
|
# This will be logged as well but the important thing is to
|
|
|
# annoy other accesspoints in your wireless territory.
|
|
|
hostap handle type data bssid !<myess> \
|
|
|
with frame type management subtype deauth reason auth expire \
|
|
|
from &bssid to ff:ff:ff:ff:ff:ff bssid &bssid
|
|
|
|
|
|
# The first de-auth example will not work with some newer stuff, like
|
|
|
# iwi(4)/ipw(4) "centrino", because they ignore management frames to
|
|
|
# the broadcast address as a countermeasure against the "void11"
|
|
|
# attack.
|
|
|
#
|
|
|
# hostap handle type data bssid !<myess> \
|
|
|
# with frame type management subtype deauth reason auth expire \
|
|
|
# from &bssid to &from bssid &bssid
|
|
|
|
|
|
# Detect flooding of management frames except beacons.
|
|
|
# This will detect some possible Denial of Service attacks
|
|
|
# against the IEEE 802.11 protocol (like "void11").
|
|
|
hostap handle skip type management subtype ! beacon \
|
|
|
with log \
|
|
|
rate 100 / 10 sec
|
|
|
|
|
|
# Finally log any rogue accesspoints limited to every second.
|
|
|
hostap handle skip type management subtype beacon bssid !<myess> \
|
|
|
with iapp type radiotap limit 1 sec
|
|
|
|