WiFi FTM Linux Tool

Main Page | FAQ

Installation Instructions

These instructions have been tested to work on Linux operating systems that are based on a Linux kernel version 3.19.0-61-lowlatency.

1. Prerequisites

Install the build tools, the Linux development headers, and the Git client. On Ubuntu, run:

$ sudo apt-get install gcc make linux-headers-$(uname -r) git-core

2. Build and Install the Modified Wireless Driver

FTM protocol is only supported by the backport LinuxCore releases of the IWLWIFI driver. We use IWLWIFI driver from the LinuxCore30 release. You can follow the installation steps on the webpage of LinuxCore releases. Download the sources of the driver:

$ git clone https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/backport-iwlwifi.git -b release/LinuxCore30

Make the sources with vendor commands disabled:

$ make defconfig-iwlwifi-public
$ sed -i 's/CPTCFG_IWLMVM_VENDOR_CMDS=y/# CPTCFG_IWLMVM_VENDOR_CMDS is not set/' .config
$ make -j4

Add our patch to the driver (folder name LinuxCore30), to enable the device as FTM responder whenever being configured to access point mode:

$ patch -s -p0 < patch_enableFTMResponder.txt

Now it is time to install the modified modules that you built:

$ sudo make install


3. Install the Firmware

Download the required firmware (version 31) for the Intel Dual Band Wireless-AC 8260 cards (more details about the firmware can be found on linux-firmware clone):

$ wget https://git.kernel.org/cgit/linux/kernel/git/iwlwifi/linux-firmware.git/plain/iwlwifi-8000C-31.ucode

Install the firmware:

$ sudo cp iwlwifi-8000C-31.ucode /lib/firmware/

Add the driver module, iwlwifi, to the Linux Kernel:

$ modprobe iwlwifi

4. Configure FTM Responding Access Point

To configure a device to access point mode, we need to use hostapd. We use version 2.6:

$ wget http://w1.fi/releases/hostapd-2.6.tar.gz
$ tar xzvf hostapd-2.6.tar.gz
$ cd hostapd-2.6/hostapd

Before the installation, we need to enable nl80211 driver support as long as 802.11n, and 802.11ac support:

$ cp defconfig .config
$ vi .config

Now, uncomment the following lines by removing the '#' signs:


Make sure to install/update libnl-dev, then compile:

$ make

In the configuration file (try hostapd-minimal.conf), publish FTM responder functionality (in the beacon frames), by uncommenting the following line:


Then, run hostapd, to configure the device as AP

hostapd $ ./hostapd ./hostapd-minimal.conf

5. Configure FTM Initiating Station

Download iw version 4.9. iw is nl80211 based CLI configuration utility for wireless devices in Linux to configure the STA node

$ wget https://git.kernel.org/pub/scm/linux/kernel/git/jberg/iw.git/snapshot/iw-4.9.tar.gz
$ tar xzvf iw-4.9.tar.gz
$ cd iw/

Download a patch, develponed by Johannes Berg, that enables iw to send FTM request and print the reply back. Add the patch to iw and then compile:

$ wget https://p.sipsolutions.net/bef149ad0c1b8c8f.txt
$ patch -p1 < bef149ad0c1b8c8f.txt
$ make

6. Ranging Test

Prepare a configuration file that includes information needed to send FTM request to the AP. Example:

$ echo bb:bb:bb:bb:bb:bb bw=20 cf=2412 asap > conf

In this configuration, we target an AP with bb:bb:bb:bb:bb:bb MAC address, 20MHz bandwidth and frequency is 2412 MHz, with ASAP mode set to 1. To send FTM request:

$ ./iw wlan0 measurement ftm_request conf
phy #1: FTM result! Status: 0
Target: bb:bb:bb:bb:bb:bb, status: 0, rtt: 153466 psec, distance: 2301 cm

7. WiFi Scan with Ranging

In order to measure the distances to the surrounding APs, we need to collect information about the APs, including MAC addresses, bandwidth, frequency, and the support for FTM protocol:

We prepared scripts (wifiScanWithRanging and processScan) that scan the surrounding APs, and collect the required information for FTM ranging, and start ranging:

$ ./wifiScanWithRanging --spb=3 --ftmSupport=0 --scanPeriod=5
phy #1: FTM result! Status: 0
Target: bb:bb:bb:bb:bb:bb, status: 0, rtt: 153466 psec, distance: 2301 cm
phy #1: FTM result! Status: 0
Target: cc:cc:cc:cc:cc:cc, status: 4, rtt: 153466 psec, distance: 0 cm
phy #1: FTM result! Status: 0
Target: aa:aa:aa:aa:aa:aa, status: 4, rtt: 0 psec, distance: 0 cm

For this example, when we start ranging, set the spb (number of samples per burst) to 3 (default is 2) and send FTM requests to all the surrounding APs. If we set the the ftmSupport (default is 0) parameter to 1, we limit the ranging process to only the APs that publish the support for FTM responder. The tool scans the surrouding APs every n seconds based on the scanPeriod (default is 5 seconds) parameter and continously send ranging requests to them.