Beefy Boxes and Bandwidth Generously Provided by pair Networks DiBona
"be consistent"
 
PerlMonks  

Re^3: Net::Pcap with wireless

by traveler (Parson)
on Sep 13, 2009 at 17:55 UTC ( #795012=note: print w/ replies, xml ) Need Help??


in reply to Re^2: Net::Pcap with wireless
in thread Net::Pcap with wireless

So do those MAC addresses match the card and AP? It seems that you are doing an Ethernet decode. Doing that will miss some info from the 802.11 frame, but if you don't care about that, it really doesn't make any difference.


Comment on Re^3: Net::Pcap with wireless
Re^4: Net::Pcap with wireless
by trevelyn (Novice) on Sep 13, 2009 at 18:21 UTC
    nope, that's not a MAC address, if i switch interfaces to wired ethernet (eth0), i see the MAC addresses of the windows computer i use PuTTY from and the Linux box with the wireless.pl app on it perfectly flying by.
    Also, I don't really care about the payload, i just need the MAC addresses.
    I can write another thread for channel hopping later using iwconfig or a Perl module to iwconfig later. I just want to make sure i can get MACs from the same data i see the plain text ESSID's.

    My Net::Pcap is up to date: Net::Pcap is up to date (0.16). and i don't see a module for NetPacket for 802.11, but i do see a section in the Net::Pcap file on the CPAN site that says:
    :datalink exports the data link types macros:
    "DLT_IEEE802_11 - IEEE 802.11 wireless LAN"

    as an exporter tag. Does that mean I need to do: "use Exporter;" and "export" them? that part confused me a bit, heh. Thanks again, man :)
      I don't have a linux machine with wireless here to test with, but I think it means you need to tell pcap that it is getting 802.11 frames. Do this with pcap_set_datalink().
Re^4: Net::Pcap with wireless
by trevelyn (Novice) on Oct 25, 2009 at 16:32 UTC
    Well, I tried setting the data link type with this:
    #!/usr/bin/perl -w # by trevelyn. # use warnings; use Net::Pcap; use NetPacket::Ethernet; use NetPacket::IP; use NetPacket::TCP; my $error; my $type = 'DLT_IEEE802_11'; my $device = $ARGV[0]; my $WiFiobject = Net::Pcap::open_live($device, 2048, 1, -1, \$error); my $w802 = Net::Pcap::datalink($type); Net::Pcap::set_datalink($Wifiobject, $w802); unless (defined $WiFiobject) { die 'Unable to create packet capture on + device ', $device, ' - ', $error; } Net::Pcap::loop($WiFiobject, -1, \&syn_packets, '') || die 'Unable to +perform packet capture'; Net::Pcap::close($WiFiobject); sub syn_packets { my ($user_data, $header, $packet) = @_; my $macaddr = NetPacket::Ethernet->decode($packet); print "$macaddr->{'src_mac'}, $macaddr->{'dest_mac'}\n"; }
    Doesn't seem to want to work at all anymore. I am completely lost now? :(
      Try this. It's a little better, but needs some work:-)

      #!/usr/bin/perl use strict; use warnings; use Net::Pcap; use NetPacket::Ethernet; use NetPacket::IP; use NetPacket::TCP; my $err; my $type = 'DLT_IEEE802_11'; my $dev = Net::Pcap::lookupdev( \$err ); if ( defined $err ) { die "Unable to determine network device for monitoring - ", $err; } my ( $addr, $net, $mask ); if ( Net::Pcap::lookupnet( $dev, \$net, \$mask, \$err ) ) { die "Unable to look up device information for ", $dev, " - ", $err +; } print STDOUT "${dev}: addr/mask -> $addr/$mask\n"; my $WiFiobject = Net::Pcap::open_live( $dev, 2048, 1, -1, \$err ); my $w802 = Net::Pcap::datalink($type); Net::Pcap::set_datalink( $WiFiobject, $w802 ); unless ( defined $WiFiobject ) { die 'Unable to create packet capture on device ', $dev, ' - ', $er +r; } die 'Unable to perform packet capture' unless Net::Pcap::loop( $WiFiobject, -1, \&syn_packets, '' ); Net::Pcap::close($WiFiobject); sub syn_packets { my ( $user_data, $header, $packet ) = @_; my $macaddr = NetPacket::Ethernet->decode($packet); print "$macaddr->{'src_mac'}, $macaddr->{'dest_mac'}\n"; }

      Update: Making some progress. This is better still. I added Net::Pcap::FindDevice

      #!/usr/bin/perl use strict; use warnings; use Data::Dumper; use Net::Pcap; use Net::Pcap::FindDevice; use NetPacket::Ethernet; use NetPacket::IP; use NetPacket::TCP; my $err; my $type = 'DLT_IEEE802_11'; my $dev = find_device($ARGV[0]); my ( $addr, $net, $mask ); if ( Net::Pcap::lookupnet( $dev, \$net, \$mask, \$err ) ) { die "Unable to look up device information for ", $dev, " - ", $err +; } print STDOUT "${dev}: addr/mask -> $addr/$mask\n"; my $WiFiobject = Net::Pcap::open_live( $dev, 128000, -1, 500, \$err ); my $w802 = Net::Pcap::datalink_name_to_val($type); Net::Pcap::set_datalink( $WiFiobject, $w802 ); unless ( defined $WiFiobject ) { die 'Unable to create packet capture on device ', $dev, ' - ', $er +r; } die 'Unable to perform packet capture' unless Net::Pcap::loop( $WiFiobject, -1, \&syn_packets, '' ); print Dumper ($WiFiobject); Net::Pcap::close($WiFiobject); sub syn_packets { my ( $user_data, $header, $packet ) = @_; my $macaddr = NetPacket::Ethernet->decode($packet); print "$macaddr->{'src_mac'}, $macaddr->{'dest_mac'}\n"; }
        works perfectly with wired ethernet. I can do that with the first version i posted, but when i use wireless i get errors
        Unable to look up device information for wifi - wifi: no IPv4 address +assigned at catchme-ng.pl line 17.
        so i comment that part out and it sniffs! But it thinks all source MAC addresses are elite:
        wifi: addr/mask -> / 000031333337, 440000009000 000031333337, 440000009000 ^C
        :( I feel like i am so close. I just need to sniff MAC addresses from wireless packets (ALL). like Airodump-ng does.

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://795012]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others browsing the Monastery: (4)
As of 2014-04-21 04:54 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    April first is:







    Results (490 votes), past polls