Tcpdump/Wireless/Linux - Revision history

Admin: /* Scanning Channels */

2016-01-27T05:14:38Z

Scanning Channels

← Older revision		Revision as of 05:14, 27 January 2016
Line 64:		Line 64:
	If you run airodump-ng and only pass the network interface as an argument, it will hop among all 12 channels with your wireless card. If you run tcpdump, you will get those same channel changes for free.		If you run airodump-ng and only pass the network interface as an argument, it will hop among all 12 channels with your wireless card. If you run tcpdump, you will get those same channel changes for free.

			==Channel Hopping with Python==

			http://charlesreid1.com/wiki/Scapy/AP_Scanner

			<pre>
			#!/usr/bin/env python
			# based on airoscapy.py - Wireless AP scanner based on scapy
			# Author of airscapy: iphelix

			import sys, os, signal
			from multiprocessing import Process

			from scapy.all import *

			# Channel hopper
			def channel_hopper():
			while True:
			try:
			channel = random.randrange(1,15)
			os.system("iw dev %s set channel %d" % (interface, channel))
			time.sleep(1)
			except KeyboardInterrupt:
			break

			# Capture interrupt signal and cleanup before exiting
			def signal_handler(signal, frame):
			p.terminate()
			p.join()

			sys.exit(0)

			if __name__ == "__main__":
			if len(sys.argv) != 2:
			print "Usage %s monitor_interface" % sys.argv[0]
			sys.exit(1)

			interface = sys.argv[1]

			# Start the channel hopper
			p = Process(target = channel_hopper)
			p.start()

			# Capture CTRL-C
			signal.signal(signal.SIGINT, signal_handler)

			</pre>

	{{TcpdumpFlag}}		{{TcpdumpFlag}}

Admin at 05:05, 24 January 2016

2016-01-24T05:05:03Z

← Older revision		Revision as of 05:05, 24 January 2016
Line 3:		Line 3:
	Up one level: [[Tcpdump/Wireless]]		Up one level: [[Tcpdump/Wireless]]

	===Monitor Mode in ~~Linux~~===		=Monitor Mode=

			You should only put your card in monitor mode if you want to capture all the traffic around you. If you are using tcpdump to diagnose a wireless connection, you won't want to put your card into monitor mode.

			If you put your card into monitor mode, you will lose any connections to wireless networks that you have with that card.

			==Steps==

	Put your card into monitor mode with these steps:		Put your card into monitor mode with these steps:
Line 14:		Line 20:
	</pre>		</pre>

			=Setting the Channel=

	~~===Channel-Hopping~~ on ~~Linux===~~		To set the channel your wireless card is on (regardless of whether you are in monitor mode or not), you can use a few methods.

	~~Once~~ you~~'ve put the card into~~ monitor mode, you can ~~run <code>airodump-ng</code>, which will automatically channel-hop unless you specify~~ a ~~specific channel. Once airodump is channel-hopping, you can run tcpdump.~~

	~~Alternatively, you can set airodump to listen on a single channel~~.

	==~~=Setting~~ Channel from Shell Script===		==Single Channel from Shell Script==

	~~Another way to~~ set the channel of the ~~wireless card uses~~ iwconfig, ~~which means you can control~~ the channel ~~from a shell script~~:		To set the wireless card to listen to a single channel from the command line, use iwconfig. Specify the interface, then the keyword "channel," then the channel number:

	<pre>		<pre>
	iwconfig en1 channel 3		$ iwconfig en1 channel 3
	</pre>		</pre>

			Now you can control the channel of the wireless card from a shell script.

	You can also use <code>iwlist</code> to view available channels and see the current channel of the wireless card:		You can also use <code>iwlist</code> to view available channels and see the current channel of the wireless card:
Line 52:		Line 57:
	eth0 no frequency information.		eth0 no frequency information.
	</pre>		</pre>

			==Scanning Channels==

			If you want to channel-hop, meaning hop from channel to channel listening for a short while on each channel to get a sample of the traffic on that channel, you can do so from a shell script, which gives you more control, or you can use airodump-ng.

			If you run airodump-ng and only pass the network interface as an argument, it will hop among all 12 channels with your wireless card. If you run tcpdump, you will get those same channel changes for free.




	{{TcpdumpFlag}}		{{TcpdumpFlag}}

Admin at 03:07, 24 January 2016

2016-01-24T03:07:09Z

← Older revision		Revision as of 03:07, 24 January 2016
Line 1:		Line 1:
	~~See~~ [[Tcpdump/Wireless]]		This page covers how to use the tcpdump utility for wireless packet capture on Linux machines, and how to deal with channels.

			Up one level: [[Tcpdump/Wireless]]

	===Monitor Mode in Linux===		===Monitor Mode in Linux===
Line 11:		Line 13:
	ifconfig wlan1 up # bring wlan1 online		ifconfig wlan1 up # bring wlan1 online
	</pre>		</pre>


	===Channel-Hopping on Linux===		===Channel-Hopping on Linux===

Admin at 01:58, 24 January 2016

2016-01-24T01:58:32Z

← Older revision		Revision as of 01:58, 24 January 2016
Line 52:		Line 52:


	~~[[Category:Tcpdump]]~~		{{TcpdumpFlag}}
	~~[[Category:Networking]]~~

Admin at 21:19, 23 January 2016

2016-01-23T21:19:22Z

← Older revision		Revision as of 21:19, 23 January 2016
Line 1:		Line 1:
			See [[Tcpdump/Wireless]]

	===Monitor Mode in Linux===		===Monitor Mode in Linux===

Admin: Created page with "===Monitor Mode in Linux=== Put your card into monitor mode with these steps:

 iwconfig # list all devices ifconfig wlan1 down # assuming wlan1 is wireless iwconfig wla..."

2016-01-23T21:17:56Z

Created page with "===Monitor Mode in Linux=== Put your card into monitor mode with these steps: <pre> iwconfig # list all devices ifconfig wlan1 down # assuming wlan1 is wireless iwconfig wla..."

New page

===Monitor Mode in Linux===

Put your card into monitor mode with these steps:

<pre>
iwconfig # list all devices
ifconfig wlan1 down # assuming wlan1 is wireless
iwconfig wlan1 mode monitor # put into monitor mode
ifconfig wlan1 up # bring wlan1 online
</pre>

===Channel-Hopping on Linux===

Once you've put the card into monitor mode, you can run <code>airodump-ng</code>, which will automatically channel-hop unless you specify a specific channel. Once airodump is channel-hopping, you can run tcpdump.

Alternatively, you can set airodump to listen on a single channel.

===Setting Channel from Shell Script===

Another way to set the channel of the wireless card uses iwconfig, which means you can control the channel from a shell script:

<pre>
iwconfig en1 channel 3
</pre>

You can also use <code>iwlist</code> to view available channels and see the current channel of the wireless card:

<pre>
root@kali:~# iwlist frequency
wlan0 14 channels in total; available frequencies :
Channel 01 : 2.412 GHz
Channel 02 : 2.417 GHz
Channel 03 : 2.422 GHz
Channel 04 : 2.427 GHz
Channel 05 : 2.432 GHz
Channel 06 : 2.437 GHz
Channel 07 : 2.442 GHz
Channel 08 : 2.447 GHz
Channel 09 : 2.452 GHz
Channel 10 : 2.457 GHz
Channel 11 : 2.462 GHz
Channel 12 : 2.467 GHz
Channel 13 : 2.472 GHz
Channel 14 : 2.484 GHz
lo no frequency information.

eth0 no frequency information.
</pre>

[[Category:Tcpdump]]
[[Category:Networking]]