Optimizing a distribution for wifi pentesting

[timteboekhorst2011-debug]

@ZerBea me again 😅 i have a question should i switch to arch linux to improve performance for pentesting and should i make a triple boot so add arch linux for pentestesting and keep linux and windows for general tasks and us archlinux for pentestesting or should i switch from my main linux to arch linux

[ZerBea]

There are hundreds of "best of sites in www" e.g.:
https://www.techradar.com/best/best-linux-distros
https://www.rankred.com/best-linux-distros/
https://www.geeksforgeeks.org/linux-unix/8-most-popular-linux-distributions/
https://serveravatar.com/9-best-linux-distros-to-use-in-2025/
But I do not take it upon myself to say what distribution is appropriate for which user.

I'm on Linux since 1995 and I first used it for signal analysis. Now I'm retired (since 12 years) and I'm still on Linux.
I live at the command line level. I don't need a beautiful desktop environment like Gnome or KDE. XFCE4 is more than enough for me to handle some GUI tools. So for me Arch Linux and OpenWRT is the best choice. Everything (on both distributions) is configured by myself.

Maybe other users can tell us what distribution they use and why the do it.

The configuration of the a Linux distrubution depends very much on the user. I'll say that my configuration won't work for you.
And a pre-configured distribution is like a "Jack of all trades, master of none".

[timteboekhorst2011-debug]

Ummm hey @ZerBea can you test for me if you use the AWUS036AXML on your device (openwrt or arch) please say wich you use, but if you get packets drops when using the openwrt mediatek driver (on hcxdumptool)

[ZerBea]

hcxdumptool latest git head
Linux kernel 6.12
ALFA AWUS036AXML connected to USB2 port
Blue Tooth not installed
Absolutely no unnecessary service is running

$ time sudo hcxdumptool -w test.pcapng -c 13a --tot=5 -i wlp0s20f0u2i3
This is a highly experimental penetration testing tool!
It is made to detect vulnerabilities in your NETWORK mercilessly!
Misuse within a network, without specific authorization, may cause
irreparable damage and result in significant consequences!
Not understanding what you were doing is not going to work as an excuse!

BPF is unset! Make sure hcxdumptool is running in a 100% controlled environment!

starting...

4470 Packet(s) captured by kernel
0 Packet(s) dropped by kernel
exit on TOT

real	5m4,726s
user	0m0,009s
sys	0m0,016s

Some more information:
https://www.baeldung.com/linux/packet-drops-troubleshooting

[timteboekhorst2011-debug]

Okay now i know its not a driver issue or a kernel issue but to many unnasseccery services (because i terminated some and instead of 200 packets on mdk4 those where not even every second it gone to 2000 packets and consistent every second instead of sometimes) or a hardware issue (but i think it cannot be the distro its just whats on the distro like WM and DE and basic services) so thanks for your help and that you tested it👌👍

[ZerBea]

Configuring the Linux distribution is only half of what you can/should to.
The same applies to the Linux kernel. I'm running a custom kernel. Features I don't want/need, are not compiled in! For example the size of my custom kernel (kernel.img) is about 11M only.
You have mentioned that you use mdk4. I wonder why it doesn't report kernel packet drops. A state of the art penetration testing tool should do that.

[timteboekhorst2011-debug]

Mayby its a option but doesn't look like it

[timteboekhorst2011-debug]

But i think powersaving wifi was the problem

[timteboekhorst2011-debug]

My packets are now only 14 dropped instead of half

[ZerBea]

The AXML doesn't accept power save settings via NETLINK. Booth tools (iw and hcxdumptool) fail epically:

$ iw wlp48s0f4u2u3i3 get power_save
Power save: on
$ sudo iw wlp48s0f4u2u3i3 set power_save off
command failed: Operation not supported (-95)

$ sudo hcxdumptool -m wlp48s0f4u2u3i3
...
monitor mode is active...
$ iw wlp48s0f4u2u3i3 get power_save
Power save: on

My packets are now only 14 dropped instead of half

A well configured distribution and a custom kernel is the measure of all things!

[timteboekhorst2011-debug]

Now idk hoe but when disabling power saving it worked sooo idk whats gone right or wrong 🤣

[ZerBea]

Glad to hear that it is working, now.
The AXML doesn't allow power save settings when running on Arch Linux default distribution Kernel (6.17.4-arch2-1).

[timteboekhorst2011-debug]

Mayby the axm does?

[timteboekhorst2011-debug]

@ZerBea yeah ok gonns test other systems its higly unstable my results i can't just get it right

[timteboekhorst2011-debug]

like i think its mayby crazy but no operating system now satisfies me of my needs so i think i am going down the rabbit hole of making my own distro and kernel

[ZerBea]

but no operating system now satisfies me

That always happens if you install a "Distribution that claims to satisfy all purposes" and use its default configuration. Do not wrestle with such a Distribution and try to stop, remove or re-configure everything.

Instead choose a lightweight Linux distribution and install it from scratch (definitely not with a GUI installer).
Do everything by hand:

• partition table (parted is your friend)
• systemd-boot (with longterm kernel, stable kernel and custom kernel) https://www.maketecheasier.com/grub-vs-systemd-boot/
• lightweight window manager (LXDM) https://askubuntu.com/questions/81745/which-is-lighter-quicker-lxdm-or-lightdm
• lightweight desktop (XFCE4 or LXDE) https://www.debugpoint.com/xfce-vs-gnome/
• install and enable only service you really need
• install only tools (end development files) that you really need)
  configure everything

[timteboekhorst2011-debug]

gpg: Signature made 10/01/25 18:11:41 W. Europe Daylight Time
gpg: using EDDSA key 3E80CA1A8B89F69CBA57D98A76A5EF9054449A5C
gpg: issuer "[email protected]"
gpg: Good signature from "Pierre Schmitz [email protected]" [unknown]
gpg: aka "Pierre Schmitz [email protected]" [unknown]
gpg: WARNING: The key's User ID is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: 3E80 CA1A 8B89 F69C BA57 D98A 76A5 EF90 5444 9A5C
ummm @ZerBea what to do ?

[ZerBea]

You are still inside the live iso. Install Arch ss mentioned here:
https://wiki.archlinux.org/title/Installation_guide

[timteboekhorst2011-debug]

? I was on windows testing signature with a Windows signature app

[ZerBea]

https://pierre-schmitz.com/gpg-keys/

[timteboekhorst2011-debug]

Should i use dd image mode or iso image mode i now have dd because it doesn't work with iso but dd mode doesn't work either except if i temporarily disable secure boot so should i now stick with dd mode or rewrite in iso mode @ZerBea

[ZerBea]

I use:
$ sudo dd bs=4M if=archlinux-2025.10.01-x86_64.iso of=/dev/sda status=progress oflag=sync
according to this:
https://wiki.archlinux.org/title/USB_flash_installation_medium

BTW:
Arch has an excellent forum. Nearly all questions are answered there:
https://bbs.archlinux.org/

and an excellent wiki:
https://wiki.archlinux.org/title/Main_page

additional all maintainers and their PGP keys are mentioned here:
https://archlinux.org/master-keys/

[timteboekhorst2011-debug]

Ok yeah i used rufus so there was a small thing there but not much so i am gonna do dd because is see sudo dd