How can I use TDLS (802.11z) for SSH connections on my LAN?

4

2

Tunneled Direct Link Setup, or TDLS is an amendment to IEEE 802.11 that allows two devices on a LAN to connect directly to each other, bypassing the router. This is very useful if the router is slow but the devices on the LAN are fast. In my case, I would like to use TDLS to establish a SSH connection so I can transfer files using SCP without the slow router needing to route the traffic.

Is there any way to set this up on Linux, using standard networking utilities?

forest

Posted 2018-06-30T06:41:45.447

Reputation: 607

Are you sure your devices support TDLS ? If I understand correctly, this would happen seemlessly in the background if both devices support it and are on the same network subnet. (btw - while packets would pass through the AP componenet of the router, the router does not route the traffic, as passing packets is done at the switching, not routing level) – davidgo – 2018-06-30T08:30:50.460

1

@davidgo Both devices' networking cards support TDLS. Does it really happen seamlessly? I was under the impression that software would have to initiate it, not the networking stack or hardware.

– forest – 2018-06-30T08:32:50.183

I'm speculating a tiny bit here (hence the comment), but I imagine wpa_supplicant would require support because a handoff will require negotiation of encryption keys so the devices can talk directly to each other. I got my info from https://www.infoworld.com/article/2615053/wide-area-networking/wi-fi-alliance-starts-certifying-tunnel-technology-for-better-wireless-performa.html which states ...

– davidgo – 2018-06-30T08:35:45.487

"TDLS is based on the IEEE 802.11z standard, and the automatic link configuration is done in a couple of steps. The discovery process begins when one device sends a discovery request to another device, via the network they are connected to. If the target device is also TDLS compliant, then it sends a response directly to the initiator, providing information on its capabilities, including supported rates and channels." – davidgo – 2018-06-30T08:35:53.330

So TDLS would be initiated transparently even if the end software is not aware of it, as long as both wireless cards, the kernel, and wpa_supplicant support it? – forest – 2018-06-30T08:38:10.650

I am pretty sure that is the case - as 802.11 operates below the IP level - "all" that this technology is doing is removing the switching typically required by the AP (think of the AP like a regular switch but for WIFI packets - with TDLS creating a virtual ethernet cable directly between the 2 machines). – davidgo – 2018-06-30T08:45:55.467

@davidgo If you can write that as an answer and back it up with an authoritative source (a quote from the RFC for example, which is a little better than being "pretty sure"), then I will upvote and accept it. – forest – 2018-06-30T08:47:30.880

1

Thank you for your offer. I'm unwilling to do so as I'm to new to 802.11z, and have not answered the second part of the question. BTW, the section "802.11Z TDLS 101" at http://www.securitynewspaper.com/2017/04/05/air-exploiting-broadcoms-wi-fi-stack-part-1/ is a very interesting link which if I understand it - confirms what I'm saying - but I confess my eyes start to glaze over as it gets more in-depth)

– davidgo – 2018-06-30T08:50:49.230

Thank you for the link. I will read it to see if it indeed confirms this. – forest – 2018-06-30T08:52:03.320

@forest. Rfc's (request for comments) are commonly used as an authoritive source. They are not. Anyone can sign up and write a request for comments. Here is an example: https://networkengineering.stackexchange.com/questions/44010/is-ipv10-a-joke-or-a-serious-rfc-draft this same person submitted a rfc for interconnecting satellites with fiber optics. (I emailed him about just that) and he is sadly very serious about it. I honestly thought it was a joke... Keep that in mind when you use it as an authoritive source.

– Tim_Stewart – 2018-07-05T16:16:34.573

@Tim_Stewart An RFC can however be a standard, even if anyone can write one. Sometimes they're followed to the letter (like TLS), other times they're more of suggestions than rules (as in IRC), and other times still they're just ideas. Also holy shit, satellites with fiber optics? That's... quite an undertaking, huh. – forest – 2018-07-05T20:51:22.700

@forest. It's a silly idea. I am aware that some are followed to the letter, I just figured I would give you a heads up. Lol no one ever told me. It's was actually quite amusing talking to the guy, I have a feeling he isn't actually a technical minded person by his responses. If you get bored and want to have an amusing conversation. eng.khaled.omar@hotmail.com is the person that wrote both of those ridiculous rfc's – Tim_Stewart – 2018-07-07T19:38:30.067

Answers

2

Partial answer: I've never tried to setup TDLS myself (though it sounds interesting, and I should give it a try if I can get the hardware...). So if anyone more familiar with it has actually done it, please add another answer and correct me.

First step would be to use iw phy to find out if all devices supports TDLS. Of my two connected WLAN devices, only one supports TDSL. The line that should be present is

    Device supports TDLS channel switching

As next step, note that wpa_supplicant supports TDLS. The manpage wpa_cli doesn't seem to be kept up to date, but wpa_cli help lists all supported options:

$ /sbin/wpa_cli help | grep tdls
  tdls_discover <addr> = request TDLS discovery with <addr>
  tdls_setup <addr> = request TDLS setup with <addr>
  tdls_teardown <addr> = tear down TDLS with <addr>
  tdls_chan_switch <addr> <oper class> <freq> [sec_channel_offset=] [center_freq1=] [center_freq2=] [bandwidth=] [ht|vht] = enable channel    switching with TDLS peer
  tdls_cancel_chan_switch <addr> = disable channel switching with TDLS peer <addr>

So if I could find a second WLAN device with TDLS, next thing I'd try is to run tdls_discover and then tdls_setup on both of them, and see what happens. If this results e.g. in a new network interface (ip link), setup this interface with static addresses, and ping. Once everything works, script it.

Edit

I tried to simulate a WLAN network with mac80211_hwsim to try TDLS, but it looks like this module doesn't implement TDLS at the moment.

dirkt

Posted 2018-06-30T06:41:45.447

Reputation: 11 627