How can I put mac os x en1 interface into monitor mode to use with python3 scapy?

Question

On my mac the wireless interface is the en1 interface. I can put the interface into monitor mode using mac's airport application but then it doesn't work with the scapy module when i use python 3. How can i make this work?

Thanks in advance

ifconfig output

lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
    options=3<RXCSUM,TXCSUM>
    inet6 ::1 prefixlen 128 
    inet 127.0.0.1 netmask 0xff000000 
    inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1 
    nd6 options=1<PERFORMNUD>
gif0: flags=8010<POINTOPOINT,MULTICAST> mtu 1280
stf0: flags=0<> mtu 1280
en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
    options=10b<RXCSUM,TXCSUM,VLAN_HWTAGGING,AV>
    nd6 options=1<PERFORMNUD>
    media: autoselect (none)
    status: inactive
fw0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 4078
    lladdr 00:3e:e1:ff:fe:0f:0a:4a 
    nd6 options=1<PERFORMNUD>
    media: autoselect <full-duplex>
    status: inactive
en1: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
    inet6 fe80::7ed1:c3ff:fe6e:eeda%en1 prefixlen 64 scopeid 0x6 
    inet 192.168.1.2 netmask 0xffffff00 broadcast 192.168.1.255
    nd6 options=1<PERFORMNUD>
    media: autoselect
    status: active
en2: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
    options=60<TSO4,TSO6>
    media: autoselect <full-duplex>
    status: inactive
p2p0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 2304
    media: autoselect
    status: inactive
awdl0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1452
    inet6 fe80::18b8:64ff:fec8:85%awdl0 prefixlen 64 scopeid 0x9 
    nd6 options=1<PERFORMNUD>
    media: autoselect
    status: active
bridge0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
    options=63<RXCSUM,TXCSUM,TSO4,TSO6>
    Configuration:
        id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0
        maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200
        root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0
        ipfilter disabled flags 0x2
    member: en2 flags=3<LEARNING,DISCOVER>
            ifmaxaddr 0 port 7 priority 0 path cost 0
    nd6 options=1<PERFORMNUD>
    media: <unknown type>
    status: inactive

Python Script To Detected Packets (After putting en1 into mon mode using airport)

from scapy.all import *

def pktIdentifier(pkt):
    if pkt.haslayer(Dot11Beacon):
        print ("[+] Detected 802.11 Beacon Frame")
    elif pkt.haslayer(Dot11ProbeReq):
        print ("[+] Detected 802.11 Probe Frame")
    elif pkt.haslayer(TCP):
        print ("[+] Detected TCP Packet")
    elif pky.haslayer(UDP):
        print ("[+] Detected UDP Packet")

conf.iface = 'en1'
sniff(prn=pktIdentifier)

Output of conf.route

Network         Netmask         Gateway         Iface           Output IP
0.0.0.0         0.0.0.0         192.168.0.1     en1             192.168.0.7    
127.0.0.0       255.0.0.0       0.0.0.0         lo0             127.0.0.1      
127.0.0.1       255.255.255.255 0.0.0.0         lo0             127.0.0.1      
169.254.0.0     255.255.0.0     0.0.0.0         en1             192.168.0.7    
192.168.0.0     255.255.255.0   0.0.0.0         en1             192.168.0.7    
192.168.0.1     255.255.255.255 0.0.0.0         en1             192.168.0.7    
192.168.0.1     255.255.255.255 0.0.0.0         en1             192.168.0.7    
192.168.0.7     255.255.255.255 0.0.0.0         en1             192.168.0.7    
192.168.0.255   255.255.255.255 0.0.0.0         en1             192.168.0.7 

Answer 1

Short Answer: You could MonkeyPatch the _PcapWrapper_pypcap class. An example Code is provided below.

Slightly Longer Answer: On Mac OS X scapy sniffs on interfaces through libpcap. Instead of calling pcap_open_live we call pcap_create , pcap_set_rfmon and pcap_activate (in this order). This will set the interface in monitor mode and start capturing. I tested the following MonkeyPatch under scapy-python3 (0.21) and macOS Sierra 10.12.6. Make sure you run this Code with admin rights.

from scapy.all import *

import scapy.arch.pcapdnet
from ctypes import POINTER, byref, create_string_buffer
from ctypes.util import find_library

class _PcapWrapper_pypcap_monkeypatched(scapy.arch.pcapdnet._PcapWrapper_pypcap):
    def __init__(self, device, snaplen, promisc, to_ms):
        self.errbuf = create_string_buffer(PCAP_ERRBUF_SIZE)
        self.iface = create_string_buffer(device.encode('ascii'))

        #self.pcap = pcap_open_live(self.iface, snaplen, promisc, to_ms, self.errbuf)

        STRING = c_char_p

        _lib_name = find_library("pcap")
        if not _lib_name:
            raise OSError("Cannot fine libpcap.so library")
        _lib=CDLL(_lib_name)


        pcap_create = _lib.pcap_create
        pcap_create.restype = POINTER(pcap_t)
        pcap_create.argtypes = [STRING, STRING]

        pcap_set_rfmon = _lib.pcap_set_rfmon
        pcap_set_rfmon.restype = c_int
        pcap_set_rfmon.argtypes = [POINTER(pcap_t), c_int]

        pcap_activate = _lib.pcap_activate
        pcap_activate.restype = c_int
        pcap_activate.argtypes = [POINTER(pcap_t)]


        self.pcap = pcap_create(self.iface, self.errbuf)
        pcap_set_rfmon(self.pcap, 1)
        pcap_activate(self.pcap)
        self.header = POINTER(pcap_pkthdr)()
        self.pkt_data = POINTER(c_ubyte)()
        self.bpf_program = bpf_program()

scapy.arch.pcapdnet._PcapWrapper_pypcap = _PcapWrapper_pypcap_monkeypatched

def pktIdentifier(pkt):
    if pkt.haslayer(Dot11Beacon):
        print("[+] Detected 802.11 Beacon Frame")
    elif pkt.haslayer(Dot11ProbeReq):
        print("[+] Detected 802.11 Probe Frame")

sniff(iface="en0", prn=pktIdentifier)

Answer 2

When using the sniff function setting monitor=True on Mac OS Catalina always works for me. Example: scapy.all.sniff(iface='en0, monitor=True) then obviously what ever other functions you want.

Answer 3

这是一个可能的答案： http : //www.cqure.net/wp/2014/04/scapy-with-wifi-monitor-rfmon-mode-on-os-x/如果您将在http://www.cqure.net/wp/2014/04/ /github.com/phaethon/scapy我将协助修补部分。