[英]pcap_set_rfmon succeeds but doesn't actually work
I'm currently trying to set up a simple packet sniffer with libpcap on Ubuntu 20.04.3 LTS and facing a lot of confusion over setting monitor mode with pcap_set_rfmon().我目前正在尝试在 Ubuntu 20.04.3 LTS 上使用 libpcap 设置一个简单的数据包嗅探器,并且在使用 pcap_set_rfmon() 设置监控模式时遇到了很多困惑。 A trimmed version of my code and the compilation command I used is below:
我的代码和我使用的编译命令的修剪版本如下:
g++ trimsniff.cc -g -o tsniff -L/usr/local/lib -lpcap
Code:代码:
#include <iostream>
#include <pcap/pcap.h>
#include <string>
#include <cstdlib>
#include <cstring>
using namespace std;
int main(int argc, char *argv[])
{
//Declare needed variables
const int MAX_NAME_LEN = 20;
char errbuf[PCAP_ERRBUF_SIZE];
char dev[MAX_NAME_LEN];
pcap_if_t *alldevs;
pcap_if_t *alldevsp;
pcap_t * handle;
//Check Libpcap version number
cout << pcap_lib_version() << endl << endl;
//Initialize the library for local charactr encoding & error check
if(pcap_init(PCAP_CHAR_ENC_LOCAL, errbuf))
{
fprintf(stderr, "Couldn't Initialize pcap; %s\n", errbuf);
}
else
{
cout << "PCAP Successfully Initialized" << endl << endl;
}
//trimmed version of device selection code, this assumes an
//available device was specified in the command line call
//(I make sure of this in the full code without error)
strcpy(dev, argv[1]);
cout << endl << "Selected Device: " << dev << endl << endl;
//Open device for sniffing
handle = pcap_create(dev, errbuf);
//Try setting monitor mode and error check, trimmed down to the error I'm facing
int mm_set = pcap_can_set_rfmon(handle);
if(mm_set==0)
{
fprintf(stderr, "Error setting monitor mode: Device doesn't have MM capability\n");
}
else
{
if(!pcap_set_rfmon(handle,1))
{
cout << "Monitor Mode Enabled, pcap_set_rfmon(...) == 0" << endl;
}
}
cout << endl;
//Using pcap_set_rfmon() here to illustrate issue, this will output a 0
//indicating success but the pcap_activate() error check contradicts this
cout << pcap_set_rfmon(handle,1) << endl;
//Activate the interface for sniffing
if(pcap_activate(handle))
{
cout << endl;
pcap_perror(handle,"Error");
cout << endl;
pcap_set_rfmon(handle,0);
pcap_activate(handle);
}
pcap_close(handle);
return 0;
}
My device is certainly capable of monitor mode as I've used terminal commands and aircrack-ng to monitor unassociated network traffic successfully in the past.我的设备当然能够监控模式,因为我过去曾使用终端命令和 aircrack-ng 成功监控未关联的网络流量。
But when I try to use the libpcap functions, pcap_set_rfmon() will return 0 as if it succeeds, while pcap_can_set_rfmon() contradicts this and returns 0 indicating that monitor mode cannot be set.但是当我尝试使用 libpcap 函数时, pcap_set_rfmon() 将返回 0 就好像它成功一样,而 pcap_can_set_rfmon() 与此矛盾并返回 0 表示无法设置监视模式。 The output of my trimmed code is below, the line with a zero is the output of pcap_set_rfmon(), indicating success.
我修剪后的代码的输出如下,带零的那一行是 pcap_set_rfmon() 的输出,表示成功。
libpcap version 1.11.0-PRE-GIT (with TPACKET_V3)
PCAP Successfully Initialized
Selected Device: wlx00c0caadea0a
Error setting monitor mode: Device doesn't have MM capability
0
Error: That device doesn't support monitor mode
The last error message comes from calling pcap_activate() ( using the libpcap error printing function pcap_perror() ), after trying to set monitor mode with pcap_set_rfmon().最后一条错误消息来自调用 pcap_activate() (使用 libpcap 错误打印函数 pcap_perror() ),在尝试使用 pcap_set_rfmon() 设置监视模式之后。
Does anyone know where this contradiction comes from and/or how to resolve it?有谁知道这个矛盾来自哪里和/或如何解决它?
After looking around a bit, this is apparently a problem with Linux based systems.环顾四周后,这显然是基于 Linux 的系统的问题。 Libpcap needs to link with libnl to properly set monitor mode with
pcap_set_rfmon()
, and this doesn't happen, likely due to conflicting versions of the libnl library. Libpcap 需要与 libnl 链接以使用
pcap_set_rfmon()
正确设置监视器模式,而这不会发生,可能是由于 libnl 库的版本冲突。 This function works fine on my Mac for setting monitor mode, but in Ubuntu I have to use the system()
function with ip link
and iw
console commands as a workaround.这个函数在我的 Mac 上可以很好地用于设置监视器模式,但在 Ubuntu 中我必须使用
system()
函数和ip link
和iw
控制台命令作为解决方法。 So long as you do some OS detection beforehand it's trivial to have your program decide which method to use.只要您事先进行一些操作系统检测,让您的程序决定使用哪种方法就很简单。
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.