can forward packets sniffed by monitor mode wireless interface?

[jkmin96]

Hi,

I'm a student who is working on a wireless research project.

I have a madwifi driver for Atheros chipset on Debian Linux.

With having the wireless interface get into monitor mode, I want to forward the captured packets from the wireless interface to the other Ethernet interface so that a different computer which is connected to this machine via Ethernet receives those packets.

Do you think that this is possible?
If possible, how I can make this work?

I checked that alll packets are received in the wireless interface using TCPDUMP.
I tried to forward those packets with IPTABLES like 'iptables -p FORWARD -i ath0 -o eth2 -j ACCEPT'
However, I couldn't see any packets forwarded to eth2 using TCPDUMP.

I think I don't have any basic knowledge about this and I totally miss something here.

Any opinion would be appreciated. PLEASE HELP ME


Thanks,
JK

[Kloschüssel]

You may be missing that the network card must be in promiscuous (promisc) mode. It is basically the same as the monitor mode for wireless.

[jkmin96]

Thanks for your comment.
Do you mean that I need to set the Ethernet interface as the promiscuose mode?

[jkmin96]

I tried to set the Ethernet inferface as promiscuos mode but it dosn't work.
I think the captured packets are discarded somewhere in the kernel before they are forwarded.

[Kloschüssel]

If promiscuous mode is disabled they aren't even passed on to the kernel. You would need to route the packets statically to the host you want and set the other device also in promiscuous mode so that it receives packets not targeted for that host.

[jkmin96]

To make my problem simple, I tested this simple case with iptables.

There are three nodes: a wireless node, an AP and a server.



client ---------(wireless)--------- AP -------(Ethernet)--------- server



Using iperf, client send udp or tcp packets to a server via an AP.
I run another iperf server on AP and I try to intercept the udp iperf traffic by setting the rule of iptables with "iptables -t nat -A PREROUTING -p udp -d server_IP -j DNAT --to AP_IP".
This works fine.

However, here is my problem.
I added one sniffer which has a wireless interface with monitor mode.



client ---------(wireless)--------- AP -------(Ethernet)--------- server
|
|
(wireless)
|
|
sniffer



If Iperf on client send udp traffic to the server, I can see that UDP traffic is captured in the wireless interface on the sniffer (using TCPDUMP).
And I also tried same thing as what I did on the AP in the first case.
By setting the iptables rule with "iptables -t nat -A PREROUTING -p udp -d server_IP -j DNAT --to SNIFFER_IP", I ran iperf on the sniffer, the Iperf on sniffer couldn't receive any packets.
Do I need to do extra work for iptables or something else?

Thanks,
JK

[nicandro]

Hello,
I am actually facing the same problem.. Have you got any solution so far?
Thanks a lot