RPi5 w/TP-Link Archer T2U Plus (RTL8821AU) - No data packets in Monitor Mode

[jhgarrison]

Hardware is

• RPi5, fully updated OS
• TP-Link Archer T2U Plus (Bus 001 Device 002: ID 2357:0120 TP-Link Archer T2U PLUS [RTL8821AU])
• WiFi AP is Ubiquiti U7Pro about 15ft from the desktop where I'm writing this and performing the tests described below (desktop is on wired ethernet)

Driver built and installed with no difficulties. Connections are:

Windows 11 Cygwin ssh -->(wired ethernet)--> RPi5 
RPi5 Wireshark -->(wired ethernet)-->Windows Cygwin/X display server

Wireshark is configured with "802.11 protocol Enable Decryption" and the correct key (Type: wpa-pwd, Key: [password]:[SSID])

I put the adapter into monitor mode using start-mon.sh, then adjust channel width to match my AP

sudo iw dev wlan1mon set channel 40 80MHz

Output from iw dev:

phy#1
        Interface wlan1mon
                ifindex 4
                wdev 0x100000001
                addr 98:48:27:e9:99:ad
                type monitor
                channel 40 (5200 MHz), width: 80 MHz, center1: 5210 MHz
                txpower 13.00 dBm

In both Wireshark and tcpdump (unfiltered) I see large numbers of control packets but no data packets at all.

Here's the results of various capture filters:

• net 192.168.10.0/24 or net 2601:1c0:xxxx:xxxx::/64 or net fe80::/12 (my local ipv4/6 network prefixes) - no packets captured
• wlan type data - I see 43 byte Null function (No data) packets about twice per second but nothing else.

For the following I perform some action such as using the browser on my iPhone, which is on the WiFi network, while the capture is running

• wlan ra [my iphone mac] or wlan ta [my iphone mac] - no packets captured
• wlan addr1 [my iphone mac] or wlan addr2 [my iphone mac] or wlan addr3 [my iphone mac] or wlan addr4 [my iphone mac] - Lots of short control packets but no data. Packet types are 802.11 Block Ack, Clear-to-send, Request-to-send and Trigger Buffer Status Report Poll (BSRP)

Is this just a limitation of the adapter or driver? Any suggestions on how to troubleshoot further?

[morrownr]

Hi @jhgarrison

Is this just a limitation of the adapter or driver?

Driver. Realtek does a poor job on their out-of-kernel USB drivers. A project that I have been helping with over the last just upstreamed new, Linux Wireless Standards compliant drivers for the rtl8812au, rtl8821/11au chips. The drivers are fully in kernel 6.14. In the meantime, you can go over the following repo and install the same code as an out-of-kernel drivers and it will work on kernels all the way back to 5.4:

https://github.com/lwfinger/rtw88

We need testers anyway so please do try the and report in that repo. See you there.

Don't forget to run the following to uninstall this driver:

$ sudo sh remove-driver.sh