Some problems with ettercap and MITM

[h3d0x]

Hi,

fist I want to introduce myself a bit:
My nickname is h3d0x (as you can see) and I'm from Germany. Actually I'm a software engineer (C++, Web [PHP + MySQL + JS + HTML etc.] and assembler) but I'm also interested in security related themes.

So i try to do a MITM attack and so far all is working correctly, what means: The ARP-Tables are "patched" successfully (on the router and on the iPod Touch (<- my testing device))

Network setup:
00:25:fe:68:0f:aa = 192.168.178.1 = Router
00:27:BB:C2:0C:00 = 192.168.178.26 = iPod
00:232:41:46:A9 = 192.168.178.24 = BT4-Computer

The ARP-Tables:

Router [before]:
# cat /proc/net/arp
IP address HW type Flags HW address Mask Device
192.168.178.26 0x1 0x2 00:27:BB:C2:0C:00 * lan
192.168.178.24 0x1 0x2 00:232:41:46:A9 * lan

Router [after]:
# cat /proc/net/arp
IP address HW type Flags HW address Mask Device
192.168.178.26 0x1 0x2 00:232:41:46:A9 * lan
192.168.178.24 0x1 0x2 00:232:41:46:A9 * lan

iPod [bevore]
# arp -n -a
? (192.168.178.1) at 0:25:fe:68:0f:aa on en0 [ethernet]
? (192.168.178.24) at 0:23:d2:41:46:a9 on en0 [ethernet]

iPod [after]
# arp -n -a
? (192.168.178.1) at 0:23:d2:41:46:a9 on en0 [ethernet]
? (192.168.178.24) at 0:23:d2:41:46:a9 on en0 [ethernet]

So far all right, but:

I can not either load any webpage on the iPod or ping the iPod from the router (ping 192.168.178.26)

What's wrong?

Hope anyone can help me

btw: sorry for my (probably) bad english

[Snayler]

Have you uncommented the iptables in the etter.conf file?

[sickness]

If you have uncommented the rules in etter.conf also try to check if you have any firewall on or something that might block the traffic

[gunrunr]

don't forget to set up packet forwarding otherwise MITM will work but packets will not be forwarded to their destinations

[h3d0x]

yes, i uncommented the iptable roules in the etter.conf file (located at /etc right? or is there any other conf file?) and i enabled packet forwarding ( echo 1 > /proc/sys/net/ipv4/ip_forward )

The strange thing is, i can see in the "connections-window" some DNS request's (on port 53). These are forwarded correctly to the router but no other connections are shown there (like http on port 80 or any other)

[Snayler]

located at /etc right?

Yes, that's the file. How are you running BackTrack? Did you ran the iptables command?

[sickness]

Are you following a specific tutorial ? What kind of MITM are you using from ettercap and what are you trying to achieve with this MITM ?

[h3d0x]

No, im not folowing a specific tutorial or how-to

I simply want to redirect the traffic through ettercap

next i want to edit packets etc .. but at the moment "sniffing" isnt working at all -.-

[Snayler]

Could you describe what are you doing? Commands launched, options used, etc...