Find the answer to your Linux question:
Results 1 to 7 of 7
Hi, I'm a student who is working on a wireless research project. I have a madwifi driver for Atheros chipset on Debian Linux. With having the wireless interface get into ...
Enjoy an ad free experience by logging in. Not a member yet? Register.
  1. #1
    Just Joined!
    Join Date
    May 2006
    Location
    Cary, NC
    Posts
    5

    can forward packets sniffed by monitor mode wireless interface?


    Hi,

    I'm a student who is working on a wireless research project.

    I have a madwifi driver for Atheros chipset on Debian Linux.

    With having the wireless interface get into monitor mode, I want to forward the captured packets from the wireless interface to the other Ethernet interface so that a different computer which is connected to this machine via Ethernet receives those packets.

    Do you think that this is possible?
    If possible, how I can make this work?

    I checked that alll packets are received in the wireless interface using TCPDUMP.
    I tried to forward those packets with IPTABLES like 'iptables -p FORWARD -i ath0 -o eth2 -j ACCEPT'
    However, I couldn't see any packets forwarded to eth2 using TCPDUMP.

    I think I don't have any basic knowledge about this and I totally miss something here.

    Any opinion would be appreciated. PLEASE HELP ME


    Thanks,
    JK

  2. #2
    Linux Engineer Kloschüssel's Avatar
    Join Date
    Oct 2005
    Location
    Italy
    Posts
    773
    You may be missing that the network card must be in promiscuous (promisc) mode. It is basically the same as the monitor mode for wireless.

  3. #3
    Just Joined!
    Join Date
    May 2006
    Location
    Cary, NC
    Posts
    5
    Thanks for your comment.
    Do you mean that I need to set the Ethernet interface as the promiscuose mode?

  4. $spacer_open
    $spacer_close
  5. #4
    Just Joined!
    Join Date
    May 2006
    Location
    Cary, NC
    Posts
    5
    I tried to set the Ethernet inferface as promiscuos mode but it dosn't work.
    I think the captured packets are discarded somewhere in the kernel before they are forwarded.

  6. #5
    Linux Engineer Kloschüssel's Avatar
    Join Date
    Oct 2005
    Location
    Italy
    Posts
    773
    If promiscuous mode is disabled they aren't even passed on to the kernel. You would need to route the packets statically to the host you want and set the other device also in promiscuous mode so that it receives packets not targeted for that host.

  7. #6
    Just Joined!
    Join Date
    May 2006
    Location
    Cary, NC
    Posts
    5
    To make my problem simple, I tested this simple case with iptables.

    There are three nodes: a wireless node, an AP and a server.



    client ---------(wireless)--------- AP -------(Ethernet)--------- server



    Using iperf, client send udp or tcp packets to a server via an AP.
    I run another iperf server on AP and I try to intercept the udp iperf traffic by setting the rule of iptables with "iptables -t nat -A PREROUTING -p udp -d server_IP -j DNAT --to AP_IP".
    This works fine.

    However, here is my problem.
    I added one sniffer which has a wireless interface with monitor mode.



    client ---------(wireless)--------- AP -------(Ethernet)--------- server
    |
    |
    (wireless)
    |
    |
    sniffer



    If Iperf on client send udp traffic to the server, I can see that UDP traffic is captured in the wireless interface on the sniffer (using TCPDUMP).
    And I also tried same thing as what I did on the AP in the first case.
    By setting the iptables rule with "iptables -t nat -A PREROUTING -p udp -d server_IP -j DNAT --to SNIFFER_IP", I ran iperf on the sniffer, the Iperf on sniffer couldn't receive any packets.
    Do I need to do extra work for iptables or something else?

    Thanks,
    JK

  8. #7
    Just Joined!
    Join Date
    Jan 2012
    Posts
    2
    Hello,
    I am actually facing the same problem.. Have you got any solution so far?
    Thanks a lot

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •