Wednesday, November 16, 2011

HowTo - TCPDump


# git clone git://                                                                         

Configurations [3]

Change into monitor mode [4]

wlanconfig ath0 destroy
And then to create an interface (called ath0) in monitor mode, issue the command:
wlanconfig ath0 create wlandev wifi0 wlanmode monitor
To finish bring the interface up
ifconfig ath0 up

By default, monitor mode receives packets with prism2 headers prepended on them. To change this, you must run one of the following:
  • Only 802.11 headers: echo '801' > /proc/sys/net/ath0/dev_type
  • Prism2 headers: echo '802' > /proc/sys/net/ath0/dev_type
  • Radiotap headers: echo '803' > /proc/sys/net/ath0/dev_type
  • Atheros Descriptors: echo '804' > /proc/sys/net/ath0/dev_type


Capture packets from a particular ethernet interface 

# tcpdump -i ath0 -w file -y IEEE802_11_RADIO

-i: interface
-y: radiotap header
-w: write into files

Whole package viewing[5]

# tcpdump -nnvvXSs 1514

// the final "s" increases the snaplength, grabbing the whole packet



No comments:

Post a Comment