bzuccaro/Mark-VIII
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: record on-device verification results for 5/6GHz AP

Browse Source
This commit is contained in:
bzuccaro
2026-08-18 08:24:19 -05:00
parent 12279fe29d
commit c0b9e58aa8
1 changed files with 35 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/specs/2026-08-17-radio1-5ghz6ghz-ap.md
+35 -9
View File
@@ -1,7 +1,7 @@
# Radio1 5GHz/6GHz Rogue AP — Design Record # Radio1 5GHz/6GHz Rogue AP — Design Record
- **Date:** 2026-08-17 - **Date:** 2026-08-17
- **Status:** Implemented (Tasks 1–4), on-device verification pending - **Status:** Implemented and verified on-device (see §9)
- **Owner:** Hak5 WiFi Pineapple Pager expansion project - **Owner:** Hak5 WiFi Pineapple Pager expansion project
- **Scope:** Mark VIII WebUI (`http://172.16.52.1:8080/`) running a rogue AP on - **Scope:** Mark VIII WebUI (`http://172.16.52.1:8080/`) running a rogue AP on
the Pager's second radio (`radio1` = MT7921U Wi-Fi 6E) on 5GHz and 6GHz, with the Pager's second radio (`radio1` = MT7921U Wi-Fi 6E) on 5GHz and 6GHz, with
@@ -181,11 +181,37 @@ AP is enabled:
## 9. On-device verification ## 9. On-device verification
On-device verification is **pending** (Task 5 of the implementation plan, Run against the user's Pager at `172.16.52.1` (Pineapple Pager 24.10.1). All
deferred until it can be run against the user's Pager at `172.16.52.1` without checks passed:
colliding with other agents' deployed builds). Planned checks: 2.4GHz behavior
unchanged (`wlan0open`/`radio0`/`wlan1mon` untouched), 5GHz Evil WPA - **2.4GHz unchanged:** Open AP save (channel 1) leaves `wlan0open`/`radio0`
(WPA3-SAE) bringing up `wlan1wpa` with `hop='0'`, stock Pager UI toggles intact and `pineapd.wlan1mon` untouched (`bands=2,5,6`, `hop=1`).
continuing to work, 5GHz handshake capture, reboot persistence, disable path - **5GHz Evil WPA (WPA3-SAE, channel 36, VHT80):** `radio1.band=5g`,
restoring hopping, and 5GHz Open AP. Results will be recorded here once `channel=36`, `htmode=VHT80`; `wlan1wpa` (netdev named `wlan1wpa` via
complete. `option ifname`) comes up beaconing `Test5G` / WPA3 SAE (CCMP);
`pineapd.wlan1mon.hop=0`. `get_ap` reports `wpa.enabled=true` (after the
`disabled=0` fix).
- **Stock Pager UI coexistence:** the stock daemon's own `set_ap` (what the
pager UI uses to change the 2.4GHz Evil WPA) tears down the radio1 AP
netdev; the `wlan1wpa` UCI section survives and `get_ap` self-heals it with a
`wifi reload` (`/sys/class/net/<iface>` missing check). Under rapid reload
churn the `mt7921u` driver can transiently return EBUSY; a later reload
succeeds. The pager UI itself is unaffected.
- **Handshake capture:** `Examine` on channel 36 returns success; handshake
logging (`loghandshake`/`logpartialhandshake`) confirmed on. A live WPA
handshake file requires a physical client (not exercised).
- **Reboot persistence:** `wlan1wpa` UCI, `disabled=0`, `hop=0`, the procd
Mark VIII service, and the AP itself all survive reboot.
- **Disable path:** removing the 5GHz AP deletes `wlan1wpa`, resets
`radio1.channel=auto`/`band=5g`, restores `hop=1`; `wlan1mon` hopping
resumes (observed 6GHz ch13 → ch221 in 30s).
- **5GHz Open AP:** `wlan1open` (channel 44, open) brings up `Test5GOpen`
with `hop=0`.
- **6GHz AP:** `radio1.band=6g`, `htmode=HE80`, WPA3 SAE on channel 181
(6.855 GHz) comes up.
- **Cleanup:** disable restores the 2.4GHz baseline (`pager-open`, channel 1,
`hop=1`).
Known follow-ups: the Clients tab lists only `wlan0*` interfaces, so 5GHz AP
clients are not yet shown; live-client handshake capture is untested without a
physical client.