Security

儘管網路介面處於監控或混雜模式,但仍無法嗅探流量

  • January 6, 2011

我正在嘗試嗅探我網路的無線流量,但遇到了問題。我可以將卡置於監控模式,但除了廣播、多播和探測/信標幀之外,我無法看到任何流量。

我在這台筆記型電腦上有兩個網路介面。一個正常連接到“linksys”,另一個處於監控模式。監聽模式下的介面在右聲道。我與接入點沒有關聯,因為據我所知,如果使用監控模式(與混雜)我不需要。當我嘗試 ping 路由器 ip 時,我沒有看到wireshark 中顯示該流量。

這是我的 ifconfig 設置:

daniel@seasonBlack:~$ ifconfig
eth0      Link encap:Ethernet  HWaddr 00:1f:29:9e:b2:89  
         UP BROADCAST MULTICAST  MTU:1500  Metric:1
         RX packets:0 errors:0 dropped:0 overruns:0 frame:0
         TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
         collisions:0 txqueuelen:1000 
         RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
         Interrupt:16 

lo        Link encap:Local Loopback  
         inet addr:127.0.0.1  Mask:255.0.0.0
         inet6 addr: ::1/128 Scope:Host
         UP LOOPBACK RUNNING  MTU:16436  Metric:1
         RX packets:112 errors:0 dropped:0 overruns:0 frame:0
         TX packets:112 errors:0 dropped:0 overruns:0 carrier:0
         collisions:0 txqueuelen:0 
         RX bytes:8518 (8.5 KB)  TX bytes:8518 (8.5 KB)

wlan0     Link encap:Ethernet  HWaddr 00:21:00:34:f7:f4  
         inet addr:192.168.1.116  Bcast:192.168.1.255  Mask:255.255.255.0
         inet6 addr: fe80::221:ff:fe34:f7f4/64 Scope:Link
         UP BROADCAST RUNNING  MTU:1500  Metric:1
         RX packets:9758 errors:0 dropped:0 overruns:0 frame:0
         TX packets:4869 errors:0 dropped:0 overruns:0 carrier:0
         collisions:0 txqueuelen:1000 
         RX bytes:3291516 (3.2 MB)  TX bytes:677386 (677.3 KB)

wlan1     Link encap:UNSPEC  HWaddr 00-02-72-7B-92-53-33-34-00-00-00-00-00-00-00-00  
         UP BROADCAST NOTRAILERS PROMISC ALLMULTI  MTU:1500  Metric:1
         RX packets:112754 errors:0 dropped:0 overruns:0 frame:0
         TX packets:101 errors:0 dropped:0 overruns:0 carrier:0
         collisions:0 txqueuelen:1000 
         RX bytes:18569124 (18.5 MB)  TX bytes:12874 (12.8 KB)

wmaster0  Link encap:UNSPEC  HWaddr 00-21-00-34-F7-F4-00-00-00-00-00-00-00-00-00-00  
         UP RUNNING  MTU:0  Metric:1
         RX packets:0 errors:0 dropped:0 overruns:0 frame:0
         TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
         collisions:0 txqueuelen:1000 
         RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

wmaster1  Link encap:UNSPEC  HWaddr 00-02-72-7B-92-53-00-00-00-00-00-00-00-00-00-00  
         UP RUNNING  MTU:0  Metric:1
         RX packets:0 errors:0 dropped:0 overruns:0 frame:0
         TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
         collisions:0 txqueuelen:1000 
         RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

這是我的 iwconfig 設置:

daniel@seasonBlack:~$ iwconfig
lo        no wireless extensions.

eth0      no wireless extensions.

wmaster0  no wireless extensions.

wlan0     IEEE 802.11bg  ESSID:"linksys"  
         Mode:Managed  Frequency:2.437 GHz  Access Point: 00:18:F8:D6:17:34   
         Bit Rate=54 Mb/s   Tx-Power=27 dBm   
         Retry  long limit:7   RTS thr:off   Fragment thr:off
         Power Management:off
         Link Quality=68/70  Signal level=-42 dBm  Noise level=-69 dBm
         Rx invalid nwid:0  Rx invalid crypt:0  Rx invalid frag:0
         Tx excessive retries:0  Invalid misc:0   Missed beacon:0

wmaster1  no wireless extensions.

wlan1     IEEE 802.11bg  Mode:Monitor  Frequency:2.437 GHz  Tx-Power=27 dBm   
         Retry  long limit:7   RTS thr:off   Fragment thr:off
         Power Management:off
         Link Quality:0  Signal level:0  Noise level:0
         Rx invalid nwid:0  Rx invalid crypt:0  Rx invalid frag:0
         Tx excessive retries:0  Invalid misc:0   Missed beacon:0

以下是我如何知道我在正確的頻道上:

daniel@seasonBlack:~$ iwlist channel
lo        no frequency information.

eth0      no frequency information.

wmaster0  no frequency information.

wlan0     11 channels in total; available frequencies :
         Channel 01 : 2.412 GHz
         Channel 02 : 2.417 GHz
         Channel 03 : 2.422 GHz
         Channel 04 : 2.427 GHz
         Channel 05 : 2.432 GHz
         Channel 06 : 2.437 GHz
         Channel 07 : 2.442 GHz
         Channel 08 : 2.447 GHz
         Channel 09 : 2.452 GHz
         Channel 10 : 2.457 GHz
         Channel 11 : 2.462 GHz
         Current Frequency=2.437 GHz (Channel 6)

wmaster1  no frequency information.

wlan1     11 channels in total; available frequencies :
         Channel 01 : 2.412 GHz
         Channel 02 : 2.417 GHz
         Channel 03 : 2.422 GHz
         Channel 04 : 2.427 GHz
         Channel 05 : 2.432 GHz
         Channel 06 : 2.437 GHz
         Channel 07 : 2.442 GHz
         Channel 08 : 2.447 GHz
         Channel 09 : 2.452 GHz
         Channel 10 : 2.457 GHz
         Channel 11 : 2.462 GHz
         Current Frequency=2.437 GHz (Channel 6)

好吧,我想通了。這是我在 wlan1 上的網路適配器。它必須與晶片組或驅動程序有關。

我所做的是在 wlan0 上啟用監控模式並與 wlan1 正常連接。之後,我配置了wireshark來監控wlan0介面上的流量。之後我可以看到所有的流量。

如果我錯了,有人糾正我,但原因是因為你只是在嗅探進入你機器的流量。為了查看子網上的所有流量,您必須跨越交換機上的埠或毒化交換機的 ARP 記憶體。

引用自:https://serverfault.com/questions/218774