Solder the SD Card

The first step, is to locate the SW pins (near the antenna).. simply solder some wires like this:

SD Car      -----    Fonera
DO  (pin 7)          SW1
CLK (pin 5)          SW2
DI  (pin 2)          SW5
CS  (pin 1)          SW6
Gnd (pin 3)          Gnd
Vcc (pin 4)          Vcc

Here you can see the SD Card pinouts

You can solder the VCC, and Gnd on the serial pins.

Unsolder the Caps

In my first tests, I discovered the SD card is detected, so I checked the signals. And discover the clk isn’t really clear.. So I decided to remove the capacitor on the SPI bus. (C142, C143, C144, C145)

Install software and test

Next we need to install the kernel module on OpenWRT. You can find it on the Phrozen website . Simply ipkg install the file and it should be ok. Now, let’s try: insert a SD Card, and reboot, you should see something like this in your log.

Jan  1 00:00:49 OpenWrt user.warn kernel: mmc : MMC Driver for Fonera Version 2.5 (050507) -- '2B|!2B' (john@phrozen.org)
Jan  1 00:00:49 OpenWrt user.warn kernel: mmc : Card Found
Jan  1 00:00:49 OpenWrt user.warn kernel: mmc : card in op mode
Jan  1 00:00:49 OpenWrt user.warn kernel: mmc : SIZE : 241, nMUL : 6, COUNT : 1932, NAME : 256MB
Jan  1 00:00:49 OpenWrt user.warn kernel: mmc : Card Initialised
Jan  1 00:00:49 OpenWrt user.warn kernel: mmc : The inserted card has a capacity of 253231104 Bytes
Jan  1 00:00:49 OpenWrt user.warn kernel: mmc : adding disk
Jan  1 00:00:49 OpenWrt user.info kernel:  mmc1
Jan  1 00:00:49 OpenWrt user.warn kernel: mmc : Card was Found

So now you can mount it:

mount /dev/mmc0 /mnt

This stuff, is working really well, I managed to have around 150Ko/s (reading) which is far enough for my needs. The only issue right now, is that you need to carefully umount the card before removing it, otherwise the fonera will crash.

Enjoy Fonera ??

Kismet

First install Kismet. You need a wireless card that support RFMon in monitor mode. I think Madwifi cards, and patched Orinoco are the only ones that support this.

Launch Kismet, and now check for a given AP that kismet know the best level..

If everything is ok, edit the kismet config file and set gps=try

GPSDrive

Download and install the latest CVS version of GPSDrive (I have some issues with the latest tgz and kismet). The next step is to have a GPS working with gpsd. Most GPS will work, I bought a cheap one with a USB cord on ebay.

Simply launch gpsd, and after gpsdrive. You should see the reception level in GPSDrive.

MySQL

To use Kismet + GPSDrive, you need to have a MySQL database. In fact GPSDrive will ask to kismet the new APs, and dump this informations in a MySQL db. You can find the create.sql in GPSDrive sources.

mysql -u root -p < ./create.sql

This will add a user : gast / gast

First try

Ok, now launch GPSDrive and set the ‘use SQL’ (or edit the config file), and quit.

Now to start the whole stuff:

• Plug the wireless antenna (this is better for wardriving ;)
• Plug the GPS
• Launch gpsd (be carefull to have enought satellite in view)
• Launch Kismet (it should tell you, it find the GPS…)
• Launch GPSDrive (it should display a little kismet logo on bottom)
• Now, you’re ready to go, walk down the street you should see new APs on the GPSDrive map.

After the trip: Google Earth

Ok, now you have a lot of points in your database.. And GPSDrive have a little troubles to display them.. After a little time, i decided to install Google Earth, and look at the way to add new points on the map..

This, is quite simple, all i need to do is to extract data form the SQL, and build a xml file that contain all the points. I decided to write gpsdriveToGoogleEarth.py. This quick and dirty script will generate a file ‘ap.kml’. Now simply launch Google Earth and open this file. You will see something like this:

The main issue for me, is that Google Earth doesn’t support Linux right now so I need to dual-boot.. But this provide a easy way to build the card without too much pain. And i can share the Google Earth file others guys simply.

WARNING

I do this only for the fun, so don’t try to hack wireless access point using this howto, this is not the goal !

– Enjoy

My conclusion:

First:

• Take care of this antenna, I broke the first balun while testing :(
• and the balun is the hardest part to do

Tests :

• 13db of gain
• and a really big beam 120° !
• the “hot spot” of this antenna is in the middle instead what we usually see in
  omnidirectionnal. So the best height for this antenna is the same as computer.
  And this is a good news.

I usually use a biquad antenna inside my appartement, because my AP is in one corner. Biquad (or patch) offer a performance boost compare to a omnidirectionnal antenna (tested with a 8db doradus). This is mainly due to the reflections with the walls of the room inducted by the omni.

But I need to say that AMOS antenna beat all antennas I tested before in this indoor conditions. It has a larger beam (120°) and a strong front / rear insolation.

The AMOS antenna offer the best parts of the pach / quad and omnidirectionnal antennas for indoor. But take care that vertical angle is not really large so it will perhaps not work for a entire flat :).

1) Mail

First you need to have sendmail on the WRT. So install mini_sendmail. Add a file /usr/sbin/sendmail that contains:

#!/bin/sh
/usr/sbin/mini_sendmail -t -sIP_of_your_mail_relay

Check that it ‘s working..

2) Arpwatch

Run arpwatch on the WRT throught this script:

#!/bin/sh
IFNAME=$(nvram get wifi_ifname)

case $1 in
start)
touch /tmp/arpwatch.dat
arpwatch -f /tmp/arpwatch.dat -i $IFNAME
;;
stop)
killall arpwatch
;;
*)
echo "usage: $0 (start|stop)"
exit 1
esac

exit $?

3) Check

Wait a bit, connect to your wifi, look at your email on the gateway. (root@gw) you will see something like this:

From: root@openwrt.local.net
Subject: new station

hostname: <unknown>
ip address: 192.168.2.1
ethernet address: 0:f:66:c7:b5:b1
ethernet vendor: <unknown>
timestamp: Tuesday, January 18, 2000 14:34:01 +0000

Enjoy :)