Kein Traffic Mitschnitt trotz Monitor Mode

lasantarosa · Beitrag von **lasantarosa** » 12.03.2007 12:50:05

Hallo,

ich habe hier ein Problem mit meiner Intel Wireless Karte mit dem ipw2200 Treiber und dem Monitor Mode. Ich wollte in meinem WPA gesicherten Netzwerk einmal mitschneiden wer denn wieviel Traffic verbaucht... der Router unterstützt das leider nicht. Ich konnte meine Wlan Karte auch in den Monitor Mode setzen, dennoch schneiden wireshark, tcpdump, kismet... nur Beacon Signale usw. mit, keine eigentlichen Verbindungen (TCP, ICMP...).

Treiber:

Code: Alles auswählen

cat /var/log/messages |grep ipw 
Mar  9 01:10:02 localhost kernel: ipw2200: Intel(R) PRO/Wireless 2200/2915 Network Driver, 1.2.0dmq
Mar  9 01:10:02 localhost kernel: ipw2200: Copyright(c) 2003-2006 Intel Corporation
Mar  9 01:10:02 localhost kernel: ipw2200: Detected Intel PRO/Wireless 2200BG Network Connection
Mar  9 01:10:02 localhost kernel: ipw2200: Detected geography ZZM (11 802.11bg channels, 0 802.11a channels)

Verbindung zum WPA gesicherten Wlan:

Code: Alles auswählen

iwconfig
eth1      IEEE 802.11g  ESSID:"NETGEAR"
          Mode:Managed  Frequency:2.462 GHz  Access Point: 00:18:4D:5E:55:CE
          Bit Rate:48 Mb/s   Tx-Power=20 dBm   Sensitivity=8/0
          Retry limit:7   RTS thr:off   Fragment thr:off
          Encryption key:geheim...   Security mode:open
          Power Management:off
          Link Quality=75/100  Signal level=-54 dBm  Noise level=-89 dBm
          Rx invalid nwid:0  Rx invalid crypt:1405  Rx invalid frag:0
          Tx excessive retries:0  Invalid misc:47   Missed beacon:1

Nun Karte in Monitor Mode:

Code: Alles auswählen

iwconfig
eth1      unassociated  ESSID:off/any
          Mode:Monitor  Frequency=2.427 GHz  Access Point: Not-Associated
          Bit Rate:0 kb/s   Tx-Power=20 dBm   Sensitivity=8/0
          Retry limit:7   RTS thr:off   Fragment thr:off
          Encryption key:off
          Power Management:off
          Link Quality:0  Signal level:0  Noise level:0
          Rx invalid nwid:0  Rx invalid crypt:1405  Rx invalid frag:0
          Tx excessive retries:0  Invalid misc:47   Missed beacon:0

Kismet gestartet:

Code: Alles auswählen

kismet
Server options:  none
Client options:  none
Starting server...
Waiting for server to start before starting UI...
Suid priv-dropping disabled.  This may not be secure.
No specific sources given to be enabled, all will be enabled.
Enabling channel hopping.
Enabling channel splitting.
Source 0 (Kismet): Enabling monitor mode for ipw2200 source interface eth1 channel 6...
Source 0 (Kismet): Opening ipw2200 source interface eth1...
Allowing clients to fetch WEP keys.
WARNING:  Disabling GPS logging.
Logging networks to /var/log/kismet/Kismet-Mar-10-2007-1.network
Logging networks in CSV format to /var/log/kismet/Kismet-Mar-10-2007-1.csv
Logging networks in XML format to /var/log/kismet/Kismet-Mar-10-2007-1.xml
Logging cryptographically weak packets to /var/log/kismet/Kismet-Mar-10-2007-1.weak
Logging cisco product information to /var/log/kismet/Kismet-Mar-10-2007-1.cisco
Logging data to /var/log/kismet/Kismet-Mar-10-2007-1.dump
Writing data files to disk every 300 seconds.
Mangling encrypted and fuzzy data packets.
Tracking probe responses and associating probe networks.
Reading AP manufacturer data and defaults from //etc/kismet/ap_manuf
Reading client manufacturer data and defaults from //etc/kismet/client_manuf
Using network-classifier based data encryption detection
Dump file format: wiretap (local code) dump
Crypt file format: airsnort (weak packet) dump
Kismet 2006.04.R1 (Kismet)
Logging data networks CSV XML weak cisco
Listening on port 2501.
Allowing connections from 127.0.0.1/255.255.255.255
Registering builtin client/server protocols...
Registering requested alerts...
Registering builtin timer events...
Gathering packets...
Starting UI...
Looking for startup info from localhost:2501.... found.
Connected to Kismet server 2006.04.R1 on localhost:2501
Reading AP manufacturer data and defaults from //etc/kismet/ap_manuf
Reading client manufacturer data and defaults from //etc/kismet/client_manuf
Killing server...
Didn't detect any Cisco Discovery Packets, unlinking cisco dump
Didn't see any weak encryption packets, unlinking weak file
WARNING: Sometimes cards don't always come out of monitor mode
         cleanly.  If your card is not fully working, you may need to
         restart or reconfigure it for normal operation.
Kismet exiting.
Kismet exited.

Auswertung mit tcpdump

Code: Alles auswählen

tcpdump -r /var/log/kismet/Kismet-Mar-10-2007-1.dump
12:03:04.877802 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
12:03:04.890873 Clear-To-Send RA:00:18:4d:5e:55:ce (oui Unknown)
12:03:04.923750 Clear-To-Send RA:00:18:4d:5e:55:ce (oui Unknown)
12:03:04.980197 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
12:03:05.584948 Clear-To-Send RA:00:13:02:54:6e:94 (oui Unknown)
12:03:05.585073 Acknowledgment RA:00:13:02:54:6e:94 (oui Unknown)
12:03:05.594585 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
12:03:05.696995 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
12:03:07.028217 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
12:03:07.130597 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
12:03:07.146327 Clear-To-Send RA:00:18:4d:5e:55:ce (oui Unknown)
12:03:07.232999 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
12:03:07.642608 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
12:03:07.745003 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
12:03:08.204439 Beacon (belkin54g) [1.0* 2.0* 5.5* 11.0* 18.0 24.0 36.0 54.0 Mbit] ESS CH: 11
12:03:08.257004 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
12:03:08.306838 Beacon (belkin54g) [1.0* 2.0* 5.5* 11.0* 18.0 24.0 36.0 54.0 Mbit] ESS CH: 11
12:03:08.359407 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
12:03:09.563555 Clear-To-Send RA:00:18:4d:5e:55:ce (oui Unknown)
12:03:09.564078 Clear-To-Send RA:00:18:4d:5e:55:ce (oui Unknown)
12:03:09.578780 Clear-To-Send RA:00:18:4d:5e:55:ce (oui Unknown)
12:03:09.597007 Clear-To-Send RA:00:18:4d:5e:55:ce (oui Unknown)
12:03:09.597519 Clear-To-Send RA:00:18:4d:5e:55:ce (oui Unknown)
12:03:09.613264 Clear-To-Send RA:00:18:4d:5e:55:ce (oui Unknown)
12:03:09.690618 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
12:03:10.041007 Clear-To-Send RA:00:18:4d:5e:55:ce (oui Unknown)
12:03:10.042163 Clear-To-Send RA:00:18:4d:5e:55:ce (oui Unknown)
12:03:10.056206 Clear-To-Send RA:00:18:4d:5e:55:ce (oui Unknown)
12:03:10.077727 Clear-To-Send RA:00:18:4d:5e:55:ce (oui Unknown)
12:03:10.078253 Clear-To-Send RA:00:18:4d:5e:55:ce (oui Unknown)
12:03:10.079168 Clear-To-Send RA:00:18:4d:5e:55:ce (oui Unknown)
12:03:10.098416 Clear-To-Send RA:00:18:4d:5e:55:ce (oui Unknown)
12:03:10.099065 Clear-To-Send RA:00:18:4d:5e:55:ce (oui Unknown)
12:03:10.100344 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
12:03:10.112463 Clear-To-Send RA:00:18:4d:5e:55:ce (oui Unknown)
12:03:10.113157 Clear-To-Send RA:00:18:4d:5e:55:ce (oui Unknown)
12:03:10.202621 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY

Während Kismet lief habe ich auf einem anderen Rechner einen Ping auf google.com laufen lassen, doch der taucht nirgends in der Logfile auf!

Hat da jemand eine Ahnung was da falsch läuft?

Danke.

aspettl · Beitrag von **aspettl** » 12.03.2007 13:51:24

Hi

Ich habe es noch nie gemacht, aber mal folgende Befehle dafür notiert:

Code: Alles auswählen

echo 1 > /sys/bus/pci/drivers/ipw2200/*/rtap_iface
ifconfig rtap0 up

Vielleicht ist es das, was du suchst

Gruß
Aaron

lasantarosa · Beitrag von **lasantarosa** » 12.03.2007 14:18:26

Hi,

ich dachte das rtap interface ist dafür da einen Quasi Monitor Mode zu haben und gleichzeitig eine normale Verbindung.

Danielx · Beitrag von **Danielx** » 12.03.2007 23:34:56

lasantarosa hat geschrieben:ich dachte das rtap interface ist dafür da einen Quasi Monitor Mode zu haben und gleichzeitig eine normale Verbindung.

Ja, genau:

README.ipw3945 hat geschrieben:rtap_iface
Set to 1 to create a promiscuous radiotap interface. This
interface will be set to type ARPHRD_IEEE80211_RADIOTAP and will
be passed every frame received over the air by the adapter.

Vielleicht setzt irgendein Programm den Monitor Mode wieder zurück?
Ist mir jedenfalls schon passiert.
Überprüfe doch mal während z.B. wireshark mitschneidet, ob deine Wlan Karte auch weiterhin im Monitor Mode ist!
Und warum probierst du nicht mal, über das Interface rtap0 mitzuschneiden (siehe aspettl)?
Über rtap0 geht alles drüber, egal ob die Karte im Monitor Mode ist oder nicht!

Gruß
Daniel

lasantarosa · Beitrag von **lasantarosa** » 13.03.2007 02:04:57

Hey,

also davor hatte immer der wpa suplicant die Karte wieder zurückgestellt, den hatte ich nun aber schon immer ausgeschaltet. Also die Karte war ständig im Monitor Mode, hatte ich auch schon überprüft.

Ich werde nun heute aber auf jeden Fall mal das rtap Interface testen. Ich schreib dann mal was passiert ist.

Danke.

lasantarosa · Beitrag von **lasantarosa** » 13.03.2007 03:41:14

Ok, ich habe jetzt das rtap Device drauf:

Code: Alles auswählen

iwconfig
eth0      no wireless extensions.

lo        no wireless extensions.

sit0      no wireless extensions.

eth1      IEEE 802.11g  ESSID:"NETGEAR"
          Mode:Managed  Frequency:2.462 GHz  Access Point: 00:18:4D:5E:55:CE
          Bit Rate:48 Mb/s   Tx-Power=20 dBm   Sensitivity=8/0
          Retry limit:7   RTS thr:off   Fragment thr:off
          Encryption key:geheim Security mode:open
          Power Management:off
          Link Quality=94/100  Signal level=-23 dBm  Noise level=-88 dBm
          Rx invalid nwid:0  Rx invalid crypt:0  Rx invalid frag:0
          Tx excessive retries:1  Invalid misc:0   Missed beacon:1

rtap0     no wireless extensions.

Code: Alles auswählen

ifconfig 
rtap0     Protokoll:UNSPEC  Hardware Adresse 00-00-00-00-00-00-30-3A-00-00-00-00-00-00-00-00
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:691 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          Kollisionen:0 Sendewarteschlangenlänge:1000
          RX bytes:94520 (92.3 KiB)  TX bytes:0 (0.0 b)

Schneide ich nun mit, bekomme ich wieder nur Beacon Frames, sogar wenn ich nun z.B. einen Ping von meinem eigenen Rechner auf meinen Router mache, wenigstens den eigenen Traffic müsste es ja mitschneiden!

Code: Alles auswählen

tcpdump -i rtap0
tcpdump: WARNING: rtap0: no IPv4 address assigned
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on rtap0, link-type IEEE802_11_RADIO (802.11 plus BSD radio information header), capture size 96 bytes
13:40:53.527381 18446744072227455415us tsft 1.0 Mb/s 2462 MHz (0x00a0) -27dB signal 0dB noise antenna 2 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
13:40:53.601529 2462 MHz (0x00c0) Data IV:632404 Pad 20 KeyID 0
13:40:53.603172 0us tsft 36.0 Mb/s 2462 MHz (0x00c0) -27dB signal 0dB noise antenna 2 Data IV:b12404 Pad 20 KeyID 0
13:40:53.629781 18446744072227557815us tsft 1.0 Mb/s 2462 MHz (0x00a0) -27dB signal 0dB noise antenna 2 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
13:40:53.732190 18446744072227660223us tsft 1.0 Mb/s 2462 MHz (0x00a0) -27dB signal 0dB noise antenna 2 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
13:40:53.834582 18446744072227762615us tsft 1.0 Mb/s 2462 MHz (0x00a0) -27dB signal 0dB noise antenna 2 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
13:40:53.936993 18446744072227865023us tsft 1.0 Mb/s 2462 MHz (0x00a0) -27dB signal 0dB noise antenna 2 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
13:40:53.982390 0us tsft 1.0 Mb/s 2462 MHz (0x00a0) -29dB signal 0dB noise antenna 2 Probe Request (NETGEAR) [1.0* 2.0* 5.5* 11.0* Mbit]
13:40:53.983147 18446744072227912025us tsft 11.0 Mb/s 2462 MHz (0x00a0) -29dB signal 0dB noise antenna 2 Probe Response (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] CH: 11, PRIVACY
13:40:54.039387 18446744072227967415us tsft 1.0 Mb/s 2462 MHz (0x00a0) -29dB signal 0dB noise antenna 2 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
13:40:54.141787 18446744072228069815us tsft 1.0 Mb/s 2462 MHz (0x00a0) -29dB signal 0dB noise antenna 2 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
13:40:54.244195 18446744072228172223us tsft 1.0 Mb/s 2462 MHz (0x00a0) -29dB signal 0dB noise antenna 2 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
13:40:54.346586 18446744072228274615us tsft 1.0 Mb/s 2462 MHz (0x00a0) -28dB signal 0dB noise antenna 2 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
13:40:54.448988 18446744072228377015us tsft 1.0 Mb/s 2462 MHz (0x00a0) -28dB signal 0dB noise antenna 2 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
13:40:54.551410 18446744072228479438us tsft 1.0 Mb/s 2462 MHz (0x00a0) -28dB signal 0dB noise antenna 2 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
13:40:54.607926 2462 MHz (0x00c0) Data IV:642404 Pad 20 KeyID 0
13:40:54.609779 0us tsft 24.0 Mb/s 2462 MHz (0x00c0) -28dB signal 0dB noise antenna 2 Data IV:b22404 Pad 20 KeyID 0
13:40:54.653788 18446744072228581815us tsft 1.0 Mb/s 2462 MHz (0x00a0) -28dB signal 0dB noise antenna 2 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
13:40:54.756190 18446744072228684215us tsft 1.0 Mb/s 2462 MHz (0x00a0) -27dB signal 0dB noise antenna 2 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
13:40:54.858590 18446744072228786615us tsft 1.0 Mb/s 2462 MHz (0x00a0) -27dB signal 0dB noise antenna 2 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
13:40:54.960985 18446744072228889015us tsft 1.0 Mb/s 2462 MHz (0x00a0) -27dB signal 0dB noise antenna 2 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
13:40:55.063400 18446744072228991422us tsft 1.0 Mb/s 2462 MHz (0x00a0) -27dB signal 0dB noise antenna 2 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
13:40:55.165793 18446744072229093816us tsft 1.0 Mb/s 2462 MHz (0x00a0) -27dB signal 0dB noise antenna 2 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
13:40:55.268212 18446744072229196231us tsft 1.0 Mb/s 2462 MHz (0x00a0) -27dB signal 0dB noise antenna 2 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
13:40:55.370593 18446744072229298616us tsft 1.0 Mb/s 2462 MHz (0x00a0) -27dB signal 0dB noise antenna 2 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
13:40:55.472956 18446744072229401015us tsft 1.0 Mb/s 2462 MHz (0x00a0) -27dB signal 0dB noise antenna 2 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
13:40:55.514683 0us tsft 1.0 Mb/s 2462 MHz (0x00a0) -27dB signal 0dB noise antenna 2 Probe Request (NETGEAR) [1.0* 2.0* 5.5* 11.0* Mbit]
13:40:55.515450 18446744072229444318us tsft 11.0 Mb/s 2462 MHz (0x00a0) -27dB signal 0dB noise antenna 2 Probe Response (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] CH: 11, PRIVACY
13:40:55.575400 18446744072229503415us tsft 1.0 Mb/s 2462 MHz (0x00a0) -27dB signal 0dB noise antenna 2 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
13:40:55.608429 2462 MHz (0x00c0) Data IV:652404 Pad 20 KeyID 0
13:40:55.610419 0us tsft 24.0 Mb/s 2462 MHz (0x00c0) -27dB signal 0dB noise antenna 2 Data IV:b32404 Pad 20 KeyID 0
13:40:55.677799 18446744072229605815us tsft 1.0 Mb/s 2462 MHz (0x00a0) -27dB signal 0dB noise antenna 2 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
13:40:55.780206 18446744072229708222us tsft 1.0 Mb/s 2462 MHz (0x00a0) -27dB signal 0dB noise antenna 2 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
13:40:55.882599 18446744072229810617us tsft 1.0 Mb/s 2462 MHz (0x00a0) -27dB signal 0dB noise antenna 2 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
13:40:55.925336 0us tsft 1.0 Mb/s 2462 MHz (0x00a0) -27dB signal 0dB noise antenna 2 Probe Request (NETGEAR) [1.0* 2.0* 5.5* 11.0* Mbit]
13:40:55.926096 18446744072229854963us tsft 11.0 Mb/s 2462 MHz (0x00a0) -27dB signal 0dB noise antenna 2 Probe Response (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] CH: 11, PRIVACY
13:40:55.985006 18446744072229913016us tsft 1.0 Mb/s 2462 MHz (0x00a0) -27dB signal 0dB noise antenna 2 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
13:40:56.087403 18446744072230015415us tsft 1.0 Mb/s 2462 MHz (0x00a0) -27dB signal 0dB noise antenna 2 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
13:40:56.189805 18446744072230117815us tsft 1.0 Mb/s 2462 MHz (0x00a0) -27dB signal 0dB noise antenna 2 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
13:40:56.292204 18446744072230220215us tsft 1.0 Mb/s 2462 MHz (0x00a0) -27dB signal 0dB noise antenna 2 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
13:40:56.394613 18446744072230322622us tsft 1.0 Mb/s 2462 MHz (0x00a0) -26dB signal 0dB noise antenna 2 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
13:40:56.497004 18446744072230425016us tsft 1.0 Mb/s 2462 MHz (0x00a0) -27dB signal 0dB noise antenna 2 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
13:40:56.536226 0us tsft 1.0 Mb/s 2462 MHz (0x00a0) -27dB signal 0dB noise antenna 2 Probe Request (NETGEAR) [1.0* 2.0* 5.5* 11.0* Mbit]
13:40:56.537005 18446744072230465865us tsft 11.0 Mb/s 2462 MHz (0x00a0) -27dB signal 0dB noise antenna 2 Probe Response (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] CH: 11, PRIVACY
13:40:56.599408 18446744072230527415us tsft 1.0 Mb/s 2462 MHz (0x00a0) -27dB signal 0dB noise antenna 2 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
13:40:56.639601 2462 MHz (0x00c0) Data IV:662404 Pad 20 KeyID 0
13:40:56.641423 0us tsft 24.0 Mb/s 2462 MHz (0x00c0) -27dB signal 0dB noise antenna 2 Data IV:b42404 Pad 20 KeyID 0
13:40:56.701809 18446744072230629815us tsft 1.0 Mb/s 2462 MHz (0x00a0) -27dB signal 0dB noise antenna 2 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
13:40:56.804206 18446744072230732215us tsft 1.0 Mb/s 2462 MHz (0x00a0) -27dB signal 0dB noise antenna 2 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
13:40:56.906607 18446744072230834615us tsft 1.0 Mb/s 2462 MHz (0x00a0) -27dB signal 0dB noise antenna 2 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
13:40:57.009010 18446744072230937015us tsft 1.0 Mb/s 2462 MHz (0x00a0) -27dB signal 0dB noise antenna 2 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
13:40:57.111409 18446744072231039414us tsft 1.0 Mb/s 2462 MHz (0x00a0) -27dB signal 0dB noise antenna 2 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
13:40:57.213810 18446744072231141815us tsft 1.0 Mb/s 2462 MHz (0x00a0) -27dB signal 0dB noise antenna 2 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
13:40:57.316214 18446744072231244216us tsft 1.0 Mb/s 2462 MHz (0x00a0) -27dB signal 0dB noise antenna 2 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
13:40:57.357441 0us tsft 1.0 Mb/s 2462 MHz (0x00a0) -27dB signal 0dB noise antenna 2 Probe Request (NETGEAR) [1.0* 2.0* 5.5* 11.0* Mbit]
13:40:57.358220 18446744072231287074us tsft 11.0 Mb/s 2462 MHz (0x00a0) -27dB signal 0dB noise antenna 2 Probe Response (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] CH: 11, PRIVACY
13:40:57.418577 18446744072231346616us tsft 1.0 Mb/s 2462 MHz (0x00a0) -27dB signal 0dB noise antenna 2 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
13:40:57.521018 18446744072231449015us tsft 1.0 Mb/s 2462 MHz (0x00a0) -27dB signal 0dB noise antenna 2 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
13:40:57.623414 18446744072231551415us tsft 1.0 Mb/s 2462 MHz (0x00a0) -27dB signal 0dB noise antenna 2 Beacon (NETGEAR) [1.0* 2.0* 5.5* 11.0* 22.0 Mbit] ESS CH: 11, PRIVACY
13:40:57.647366 2462 MHz (0x00c0) Data IV:672404 Pad 20 KeyID 0
13:40:57.649426 0us tsft 24.0 Mb/s 2462 MHz (0x00c0) -27dB signal 0dB noise antenna 2 Data IV:b52404 Pad 20 KeyID 0

62 packets captured
62 packets received by filter
0 packets dropped by kernel

Syslog bringt allerdings komische Meldungen, kann aber auch von wireshark kommen, dass das die Devices immer in verschiedene Modi setzt:

Code: Alles auswählen

tail -f /var/log/syslog
Mar 13 13:50:22 localhost kernel: device eth0 entered promiscuous mode
Mar 13 13:50:22 localhost kernel: audit(1173756022.162:162): dev=eth0 prom=256 old_prom=0 auid=4294967295
Mar 13 13:50:22 localhost kernel: device rtap0 entered promiscuous mode
Mar 13 13:50:22 localhost kernel: audit(1173756022.178:163): dev=rtap0 prom=256 old_prom=0 auid=4294967295
Mar 13 13:50:22 localhost kernel: device eth1 entered promiscuous mode
Mar 13 13:50:22 localhost kernel: audit(1173756022.194:164): dev=eth1 prom=256 old_prom=0 auid=4294967295
Mar 13 13:50:22 localhost kernel: device lo entered promiscuous mode
Mar 13 13:50:22 localhost kernel: audit(1173756022.210:165): dev=lo prom=256 old_prom=0 auid=4294967295
Mar 13 13:50:30 localhost kernel: device eth0 left promiscuous mode
Mar 13 13:50:30 localhost kernel: audit(1173756030.919:166): dev=eth0 prom=0 old_prom=256 auid=4294967295
Mar 13 13:50:30 localhost kernel: device rtap0 left promiscuous mode
Mar 13 13:50:30 localhost kernel: audit(1173756030.931:167): dev=rtap0 prom=0 old_prom=256 auid=4294967295
Mar 13 13:50:30 localhost kernel: device eth1 left promiscuous mode
Mar 13 13:50:30 localhost kernel: audit(1173756030.947:168): dev=eth1 prom=0 old_prom=256 auid=4294967295
Mar 13 13:50:30 localhost kernel: device lo left promiscuous mode
Mar 13 13:50:30 localhost kernel: audit(1173756030.979:169): dev=lo prom=0 old_prom=256 auid=4294967295
Mar 13 13:50:31 localhost kernel: device rtap0 entered promiscuous mode
Mar 13 13:50:31 localhost kernel: audit(1173756031.031:170): dev=rtap0 prom=256 old_prom=0 auid=4294967295

Ich kann rtap0 ja aber nicht manuell in irgendeinen Mode setzen.

Danke für weitere Hilfe.

Grüße

Danielx · Beitrag von **Danielx** » 14.03.2007 12:14:28

lasantarosa hat geschrieben:Schneide ich nun mit, bekomme ich wieder nur Beacon Frames, sogar wenn ich nun z.B. einen Ping von meinem eigenen Rechner auf meinen Router mache, wenigstens den eigenen Traffic müsste es ja mitschneiden!

Es werden doch jetzt Datenpakete mitgeschnitten!

Ich habe mal in deinem tcpdump nach "Data" gesucht:

Code: Alles auswählen

13:40:53.601529 2462 MHz (0x00c0) Data IV:632404 Pad 20 KeyID 0
13:40:53.603172 0us tsft 36.0 Mb/s 2462 MHz (0x00c0) -27dB signal 0dB noise antenna 2 Data IV:b12404 Pad 20 KeyID 0
13:40:54.607926 2462 MHz (0x00c0) Data IV:642404 Pad 20 KeyID 0
13:40:54.609779 0us tsft 24.0 Mb/s 2462 MHz (0x00c0) -28dB signal 0dB noise antenna 2 Data IV:b22404 Pad 20 KeyID 0
13:40:55.608429 2462 MHz (0x00c0) Data IV:652404 Pad 20 KeyID 0
13:40:55.610419 0us tsft 24.0 Mb/s 2462 MHz (0x00c0) -27dB signal 0dB noise antenna 2 Data IV:b32404 Pad 20 KeyID 0
13:40:56.639601 2462 MHz (0x00c0) Data IV:662404 Pad 20 KeyID 0
13:40:56.641423 0us tsft 24.0 Mb/s 2462 MHz (0x00c0) -27dB signal 0dB noise antenna 2 Data IV:b42404 Pad 20 KeyID 0
13:40:57.647366 2462 MHz (0x00c0) Data IV:672404 Pad 20 KeyID 0
13:40:57.649426 0us tsft 24.0 Mb/s 2462 MHz (0x00c0) -27dB signal 0dB noise antenna 2 Data IV:b52404 Pad 20 KeyID 0

Und dann noch die Zeiten dazu:

Code: Alles auswählen

13:40:53.603172
13:40:54.609779
13:40:55.608429
13:40:56.639601
13:40:57.647366

Sind so ziemlich genau immer 1 Sekunde Abstand.
Sieht mir verdächtig nach ping aus!

Kannst ja mal das hier machen:

Code: Alles auswählen

tcpdump -i rtap0 | grep Data

Dabei pingen und dann schauen ob sich was tut.

Gruß
Daniel

lasantarosa · Beitrag von **lasantarosa** » 15.03.2007 01:45:10

Oh man! Danke, hatte vor lauter rumprobieren schon halb aufgegeben und den Dump nur noch überflogen und dabei die Datenpakete übersehen.

Danke für die Hilfe.