airmon-ng check kill -- fails under ubuntu 9.10

[sleek]

The log explains the problem:
http://pastebin.ca/1649077

Final 1.0 version. It kills the pids but they automatically start again.
Ub. 9.10

[darkAudax]

sleek,

I don't use ubuntu 9.10 but it looks like there is some type of "monitor" process running.  Perhaps look at the startup services to see if anything similar to that is started.  As well, maybe ask in the Ubuntu forums as to what process is doing the restart.  I hate automatic anythings!

d.

[Arkaic]

The log explains the problem:
http://pastebin.ca/1649077

Final 1.0 version. It kills the pids but they automatically start again.
Ub. 9.10

You should experiment more.  I had this one figured out in a couple of minutes.  Did you noticed the error message if you try to stop Network Manager the old way, via /etc/init.d?


Use "stop network-manager" and "stop avahi-daemon".

[darkAudax]

Arkaic,

Good solution.  However, what is restarting them?  Normally "kill" should permanently destroy the processes.

d.

[Arkaic]

Arkaic,

Good solution.  However, what is restarting them?  Normally "kill" should permanently destroy the processes.

d.

I believe is is the new ubuntu Upstart process which handles services now.  I haven't dug into it too much.   I just noticed it on my netbook when I was experimenting with aircrack.  I just wanted services stop long enough to get things going. 

[sleek]

Arkaic,

thanks for enlightening me on how to manually stop my services...

The point of the "check kill" option is to do it automatically and speed things up.

I posted this topic, because Ubuntu is the most sought-after distro and multitude of aircrack-ng users are going to be affected which is why I think aircrack devels should be aware in order to implement the proper amendments to the code.

[darkAudax]

sleek,

Could you please see if you have that service called "upstart" and if disabling it resolves the problem.  We might need to look for and kill it off as well.

Arkaic: Maybe you can do the same as well.

Bottom line, as sleek said, this will affect a lot of people and we need to develop a solution.

d.

[Mister_X]

sleek, do these processes have a parent? Maybe we can add it to the list of things to kill.

[sleek]

ps uax |grep upstart

root      2227  0.0  0.0   2148   536 ?        S    19:25   0:00 upstart-udev-bridge --daemon

upstart-udev-bridge man page:

NAME
       upstart-udev-bridge - Bridge between Upstart and udev

SYNOPSIS
       upstart-udev-bridge [OPTIONS]...

DESCRIPTION
       upstart-udev-bridge  receives  information about kernel uevents that udev( 8 ) has completed
       and creates init( 8 ) events for them.

       This is a temporary tool until  init( 8 )  itself  gains  the  functionality  to  read  them
       directly; you should not rely on its behaviour.

Killing the upstart-udev-bridge pid resurrects again. This is the new daemon that has to be included for airmon to kill.
http://upstart.ubuntu.com/index.html

[Arkaic]

I'm glad to see that you finally poked around, and saw that it was Upstart.

Sounds familiar....oh yeah, I had mentioned it previously.

ps uax |grep upstart

root      2227  0.0  0.0   2148   536 ?        S    19:25   0:00 upstart-udev-bridge --daemon

upstart-udev-bridge man page:

NAME
       upstart-udev-bridge - Bridge between Upstart and udev

SYNOPSIS
       upstart-udev-bridge [OPTIONS]...

DESCRIPTION
       upstart-udev-bridge  receives  information about kernel uevents that udev( 8 ) has completed
       and creates init( 8 ) events for them.

       This is a temporary tool until  init( 8 )  itself  gains  the  functionality  to  read  them
       directly; you should not rely on its behaviour.

Killing the upstart-udev-bridge pid resurrects again. This is the new daemon that has to be included for airmon to kill.
http://upstart.ubuntu.com/index.html

[darkAudax]

Arkaic,

Yes, we all know you mentioned Upstart previously.  The point was to confirm exactly which process needed to be killed.  I asked both you and sleek to confirm which exact one.  sleek was kind enough to spend time to do this.  No need for sarcasm.

d.

[sleek]

From what I gather, distros from now on are going to adopt 'upstart' which is going to replace the /sbin/init daemon which manages services and tasks during boot. So it won't just be Ubuntu.

The pecking order for the new airmon-ng code should be
service network-manager stop
service avahi-daemon stop

and then proceed with grep-ing and killing the pids of dhclient and wpa_supplicant

This is the only way to kill ALL of the potentially problematic pids for aireplay-ng permanently. The trick is the kill the daemons first and then terminate the 'tasks'.