Re^3: Net::Pcap with wireless

[traveler]

So do those MAC addresses match the card and AP? It seems that you are doing an Ethernet decode. Doing that will miss some info from the 802.11 frame, but if you don't care about that, it really doesn't make any difference.

[trevelyn]

nope, that's not a MAC address, if i switch interfaces to wired ethernet (eth0), i see the MAC addresses of the windows computer i use PuTTY from and the Linux box with the wireless.pl app on it perfectly flying by.
Also, I don't really care about the payload, i just need the MAC addresses.
I can write another thread for channel hopping later using iwconfig or a Perl module to iwconfig later. I just want to make sure i can get MACs from the same data i see the plain text ESSID's.

My Net::Pcap is up to date: Net::Pcap is up to date (0.16). and i don't see a module for NetPacket for 802.11, but i do see a section in the Net::Pcap file on the CPAN site that says:
:datalink exports the data link types macros:
"DLT_IEEE802_11 - IEEE 802.11 wireless LAN"

as an exporter tag. Does that mean I need to do: "use Exporter;" and "export" them? that part confused me a bit, heh. Thanks again, man :)

[traveler]

I don't have a linux machine with wireless here to test with, but I think it means you need to tell pcap that it is getting 802.11 frames. Do this with pcap_set_datalink().

[trevelyn]

Well, I tried setting the data link type with this:

#!/usr/bin/perl -w
# by trevelyn.
#
use warnings;
use Net::Pcap;
use NetPacket::Ethernet;
use NetPacket::IP;
use NetPacket::TCP;
my $error;
my $type = 'DLT_IEEE802_11';
my $device = $ARGV[0];
my $WiFiobject = Net::Pcap::open_live($device, 2048, 1, -1, \$error);
my $w802 = Net::Pcap::datalink($type);
Net::Pcap::set_datalink($Wifiobject, $w802);

unless (defined $WiFiobject) { die 'Unable to create packet capture on
+ device ', $device, ' - ', $error; }

Net::Pcap::loop($WiFiobject, -1, \&syn_packets, '') || die 'Unable to 
+perform packet capture';
Net::Pcap::close($WiFiobject);

sub syn_packets {
        my ($user_data, $header, $packet) = @_;
        my $macaddr = NetPacket::Ethernet->decode($packet);
        print "$macaddr->{'src_mac'},  $macaddr->{'dest_mac'}\n";

}

Doesn't seem to want to work at all anymore. I am completely lost now? :(

[Khen1950fx]

Try this. It's a little better, but needs some work:-)

#!/usr/bin/perl 

use strict;
use warnings;
use Net::Pcap;
use NetPacket::Ethernet;
use NetPacket::IP;
use NetPacket::TCP;

my $err;
my $type = 'DLT_IEEE802_11';
my $dev  = Net::Pcap::lookupdev( \$err );
if ( defined $err ) {
    die "Unable to determine network device for monitoring - ", $err;
}

my ( $addr, $net, $mask );
if ( Net::Pcap::lookupnet( $dev, \$net, \$mask, \$err ) ) {
    die "Unable to look up device information for ", $dev, " - ", $err
+;
}
print STDOUT "${dev}: addr/mask -> $addr/$mask\n";

my $WiFiobject = Net::Pcap::open_live( $dev, 2048, 1, -1, \$err );
my $w802 = Net::Pcap::datalink($type);
Net::Pcap::set_datalink( $WiFiobject, $w802 );
unless ( defined $WiFiobject ) {
    die 'Unable to create packet capture on device ', $dev, ' - ', $er
+r;
}
die 'Unable to perform packet capture'
  unless Net::Pcap::loop( $WiFiobject, -1, \&syn_packets, '' );
Net::Pcap::close($WiFiobject);

sub syn_packets {
    my ( $user_data, $header, $packet ) = @_;
    my $macaddr = NetPacket::Ethernet->decode($packet);
    print "$macaddr->{'src_mac'},  $macaddr->{'dest_mac'}\n";

}

Update: Making some progress. This is better still. I added Net::Pcap::FindDevice

#!/usr/bin/perl 

use strict;
use warnings;
use Data::Dumper;
use Net::Pcap;
use Net::Pcap::FindDevice;
use NetPacket::Ethernet;
use NetPacket::IP;
use NetPacket::TCP;

my $err;
my $type = 'DLT_IEEE802_11';
my $dev  = find_device($ARGV[0]);
my ( $addr, $net, $mask );
if ( Net::Pcap::lookupnet( $dev, \$net, \$mask, \$err ) ) {
    die "Unable to look up device information for ", $dev, " - ", $err
+;
}
print STDOUT "${dev}: addr/mask -> $addr/$mask\n";

my $WiFiobject = Net::Pcap::open_live( $dev, 128000, -1, 500, \$err );
my $w802 = Net::Pcap::datalink_name_to_val($type);
Net::Pcap::set_datalink( $WiFiobject, $w802 );
unless ( defined $WiFiobject ) {
    die 'Unable to create packet capture on device ', $dev, ' - ', $er
+r;
}
die 'Unable to perform packet capture'
  unless Net::Pcap::loop( $WiFiobject, -1, \&syn_packets, '' );
print Dumper ($WiFiobject);

Net::Pcap::close($WiFiobject);

sub syn_packets {
    my ( $user_data, $header, $packet ) = @_;
    my $macaddr = NetPacket::Ethernet->decode($packet);
    print "$macaddr->{'src_mac'},  $macaddr->{'dest_mac'}\n";

}

[trevelyn]

works perfectly with wired ethernet. I can do that with the first version i posted, but when i use wireless i get errors

Unable to look up device information for wifi - wifi: no IPv4 address 
+assigned at catchme-ng.pl line 17.

so i comment that part out and it sniffs! But it thinks all source MAC addresses are elite:

wifi: addr/mask -> /
000031333337,  440000009000
000031333337,  440000009000
^C

:( I feel like i am so close. I just need to sniff MAC addresses from wireless packets (ALL). like Airodump-ng does.