Page 2 of 3 FirstFirst 123 LastLast
Results 11 to 20 of 26

Thread: Promiscuous Mode??????????

  1. #11
    Member imported_vvpalin's Avatar
    Join Date
    Apr 2009
    Posts
    442

    Default

    Quote Originally Posted by kazalku View Post
    Ok.. let's start from fresh? Why do you need promiscuous mode rather than monitor mode? I mean, the final purpose..
    The final result being able to connect to a AP and sniff all clients activity. Im about as white hat as they come, and besides we all know there is a better way to do this passivly so honestly i want to do it just so i can say i can i guess.

    iwconfig wlan0 channel #
    ifconfig wlan0 promisc
    ifconfig wlan0 up
    You know this is the only place ive been able to find that info, however i must say even tho it seems to work based on what ifconfig spits out

    This before i input

    UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
    And this after

    UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
    No matter what i do with wireshark or tcpdump i still cant see anything from my other computer ... well unless i ping it lol

    Does it need to be down before i can make the switch? Also is there a problem with the mac drivers and promisc that anyone know about?
    Using backtrack for the first time is like being 10 years old again with the keys to a Ferrari.

  2. #12

    Default

    No matter what i do with wireshark or tcpdump i still cant see anything from my other computer ... well unless i ping it lol

    Does it need to be down before i can make the switch? Also is there a problem with the mac drivers and promisc that anyone know about?
    Keep in mind that AP's act as layer 2 devices (ie. a switch), so in promisc mode, you wouldn't see traffic that isn't broadcast, multicast or destined for your specific device.
    For a test, do a broadcast ping from another connected box. You should see it show up in wireshark on the box you have promisc mode on (if your interface is connected to the same AP).

    I know of no driver problem. I tested this using an Alfa on BT4.

  3. #13
    Member imported_vvpalin's Avatar
    Join Date
    Apr 2009
    Posts
    442

    Default

    Quote Originally Posted by cybrsnpr View Post
    Keep in mind that AP's act as layer 2 devices (ie. a switch), so in promisc mode, you wouldn't see traffic that isn't broadcast, multicast or destined for your specific device.
    For a test, do a broadcast ping from another connected box. You should see it show up in wireshark on the box you have promisc mode on (if your interface is connected to the same AP).

    I know of no driver problem. I tested this using an Alfa on BT4.
    First thank you 10 times over for the help, i think i get what your saying but at the same time im even more confused.

    It was my understanding that a wired LAN more specifically say a Linksys Wired Router acted as a switch, however a wireless lan or AP multicasted everything and acted as a hub.

    I have read many many things that say its possible givin the correct card and driver set to connect to a AP and watch all traffic from clients, even lupin has said he was successful at this under one test.

    Have you ever been able connect to an AP and watch all http traffic just by opening wireshark on your alfa under bt4? Its said and even demonstrated that this is possible "altho i havent seen it done in bt however mac and win i have"
    Using backtrack for the first time is like being 10 years old again with the keys to a Ferrari.

  4. #14

    Default

    however a wireless lan or AP multicasted everything and acted as a hub
    I don't think this is true. But when you are dealing with wireless clients, the flow of traffic over the air and it's subsequent capture by another wireless device in monitor mode would be the same effect as if you were sniffing on a wired hub.

    Have you ever been able connect to an AP and watch all http traffic just by opening wireshark on your alfa under bt4?
    Just gave it a try on both an Alfa, and on an Atheros...no luck. Hmm, interesting.
    But, I always used monitor mode when I wanted to sniff on a wireless link.

    Is there a reason you don't want to use mon mode or is this just curosity?

  5. #15
    Member imported_vvpalin's Avatar
    Join Date
    Apr 2009
    Posts
    442

    Default

    Quote Originally Posted by cybrsnpr View Post

    Is there a reason you don't want to use mon mode or is this just curosity?
    Yes i just want to be able to do it and if not know why its not able to be done, as i know it is in other configurations. Its now turned into something thats going to eat me alive until i figure it out as ive put almost everything else on hold.

    However there is another reason as to why if you think about it, if dealing with WPA or WPA2 you cant sniff real time as airtune-ng doesn't support it yet .. only WEP. Is there another way to do it that im unaware of ... i tried wpa-buddy but that didnt work as it only exports to a file.

    Regardless i think this is a pretty big issue to not have a crystal clear answer for. Like i said im guessing its a driver issue as lupin has already stated he has got it to work ... Also lupin what AP's where you connecting to? Maybe that has something to do with it. Because in most references to how its possible they mention open AP's

    oh and i just noticed today is my 2 week mark with bt
    Using backtrack for the first time is like being 10 years old again with the keys to a Ferrari.

  6. #16

    Default

    if dealing with WPA or WPA2 you cant sniff real time as airtune-ng doesn't support it yet .. only WEP. Is there another way to do it that im unaware of
    Wireshark will decrypt WEP,WPA,WPA2 packets real time if you know the key.

  7. #17
    Member imported_vvpalin's Avatar
    Join Date
    Apr 2009
    Posts
    442

    Default

    Funny i hadn't thought of doing it all through wireshark.

    I know this is possible thats whats bugging me about it, that and the fact there is like 0 documentation on it. Well for doing it in BT anyways ... for windows there is plenty. Hell rite about now id be happpy just to get it working in the doze.

    Also i just tried setting my AP to open doing ifconfig wlan0 promisc and trying it with forwarding on and off ... still get nothing. You know i was just thinking, the fact that we can pick up all traffic while not connected means that the AP has to be a hub style not a switch.

    Maybe there is some setting that were missing or maybe the drivers just dont work for this.

    Its also said to work on mac's so does anyone have osx running and a alfa card so they can test it?
    Using backtrack for the first time is like being 10 years old again with the keys to a Ferrari.

  8. #18
    Super Moderator lupin's Avatar
    Join Date
    Jan 2010
    Posts
    2,943

    Default

    Quote Originally Posted by vvpalin View Post
    lupin has already stated he has got it to work ... Also lupin what AP's where you connecting to?
    Remember I was only seeing one side of the conversation though - packets going to the clients but not coming from them. I did try enabling forwarding (I assume you meant IP forwarding yes?) as you asked but it made no difference (I tested it on the Atheros card only).

    AP is a Linksys WRT54G using stock firmware.
    Capitalisation is important. It's the difference between "Helping your brother Jack off a horse" and "Helping your brother jack off a horse".

    The Forum Rules, Forum FAQ and the BackTrack Wiki... learn them, love them, live them.

  9. #19
    Member imported_vvpalin's Avatar
    Join Date
    Apr 2009
    Posts
    442

    Default

    Quote Originally Posted by lupin View Post
    Remember I was only seeing one side of the conversation though - packets going to the clients but not coming from them. I did try enabling forwarding (I assume you meant IP forwarding yes?) as you asked but it made no difference (I tested it on the Atheros card only).

    AP is a Linksys WRT54G using stock firmware.
    I tested on 2 wrt54g's one with ddwrt the other with openwrt. The thing is you WHERE able to see something, im not able to see anything.

    I wouldn't care so much if i just knew why, thats what keeps me coming back to this over and over again.
    Using backtrack for the first time is like being 10 years old again with the keys to a Ferrari.

  10. #20
    Member kazalku's Avatar
    Join Date
    Feb 2009
    Posts
    416

    Default

    Quote Originally Posted by vvpalin View Post
    I wouldn't care so much if i just knew why, thats what keeps me coming back to this over and over again.
    I like your mind-set. Keep it up.

Page 2 of 3 FirstFirst 123 LastLast

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •