Page 1 of 2 12 LastLast
Results 1 to 10 of 11

Thread: promiscuous mode

  1. #1
    Join Date
    Nov 2008
    Beans
    5

    promiscuous mode

    computer: asus eeepc 901
    distro: eeebuntu standard (wasn't a prefix option, but i believe its just ubuntu with eee drivers)

    i'm having trouble with wireless packet capture in wireshark. when i check my wifi mode in terminal, it says i am indeed in promiscuous mode, but i can only collect traffic i generate from my eeepc and router. i send irc and http packets from another computer while connected to the same router, but my eee doesn't see them.
    i've heard that the chipset used in netbooks (mine included) don't support packet injection. could this affect promiscuous mode? could promiscuous mode not be the issue?
    and a thank you in advance.
    Last edited by minie; January 26th, 2009 at 04:51 PM.

  2. #2
    Join Date
    Aug 2008
    Beans
    488

    Re: promiscuous mode

    promiscuous mode means that the networkcard will not discard information it receives which is not intended for it. So with wireshark you can look at all packets that are on the wire.

    A router however will only route packets intended for you on the wire, so you will never capture packets between to other nodes.

    packet injection has to do with sending and promiscuous with receiving.

  3. #3
    Join Date
    Nov 2008
    Beans
    5

    Re: promiscuous mode

    yes, i know what promiscuous mode is.
    both the eee and the computer i am trying to generate packets on are connected wirelessly

  4. #4
    Join Date
    Nov 2008
    Beans
    481

    Re: promiscuous mode

    I never tried this with wireless LAN, but is it possible that you
    cannot see "foreign" packages, especially if your WLAN is crypted.
    What you might need is another low-level driver to
    capture all wireless traffic, not simply promiscious mode.
    You might search for "wardriving ubuntu" on the web but keep in mind
    that you might be crossing the border between legal and illegal actions
    depending on what country you live in!

  5. #5
    Join Date
    Nov 2006
    Location
    Buckeye country
    Beans
    1,079
    Distro
    Ubuntu 12.04 Precise Pangolin

    Re: promiscuous mode

    are you running wireshark as root? if not, it won't work. go to a terminal and type
    Code:
    su wireshark

  6. #6
    Join Date
    Nov 2006
    Location
    Craggy Island.
    Beans
    Hidden!
    Distro
    Ubuntu 10.04 Lucid Lynx

    Re: promiscuous mode

    su wireshark
    hey you missed the do

    su will try to switch user wireshark

    should be
    sudo wireshark

  7. #7
    Join Date
    Nov 2008
    Beans
    5

    Re: promiscuous mode

    ya, i'm root. it actually wont let me see my interfaces unless i'm root

  8. #8
    Join Date
    Nov 2008
    Beans
    5

    Re: promiscuous mode

    bump

  9. #9
    Join Date
    Nov 2006
    Location
    Craggy Island.
    Beans
    Hidden!
    Distro
    Ubuntu 10.04 Lucid Lynx

    Re: promiscuous mode

    Hello

    I had to go back to my windows machine to see if I was doing something wrong.,

    When you go to capture->interfaces in wireshark,
    Im guessing you see the interface- wired and wireless.
    Do you see the packets incrementing in teh Packet Packets/s fields before you hit start?
    DOes IP show an IP address or unknown?

    Are all 3 fields greyed out?

    WHen you select options Do you have Capture packets in probiscous mode checked or unchecked?

    I just checked my wireless version of wireshark and it captures the packets when its unchecked and doesnt when its checked

  10. #10
    Join Date
    Jun 2006
    Location
    Ottawa, Ontario, Canada
    Beans
    25
    Distro
    Ubuntu 6.06

    Re: promiscuous mode

    Hi, not sure about WireShark as I run SNORT. In order to be able to sniff all packets on your network, your switch Port (The port you sniffing computer is on) needs to be set as a SPAN port so that all packets can flow through. Otherwise, you will only sniff what is on your local network up to your switch.


    Regards

    Marc

Page 1 of 2 12 LastLast

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •