Allegro.cc - Online Community

Allegro.cc Forums » Off-Topic Ordeals » Experience with packet sniffers?

This thread is locked; no one can reply to it. rss feed Print
Experience with packet sniffers?
Chris Katko
Member #1,881
January 2002
avatar

I want to ensure that my VPN service is not leaking anything encrypted once enabled.

I've got a Raspberry Pi and numerous other boxes lying around. I think I could go from ethernet to the sniffer, and then connect via WiFi to my normal router (of which I have no control over).

Anyone have experience with sniffers/man-in-the-middle boxes?

-----sig:
“Programs should be written for people to read, and only incidentally for machines to execute.” - Structure and Interpretation of Computer Programs
"Political Correctness is fascism disguised as manners" --George Carlin

relpatseht
Member #5,034
September 2004
avatar

The easiest way is to have the router forward all traffic to/from the target machine to the sniffing machine, which, with OpenWRT can be done as follows:

insmod xt_TEE
iptables -A POSTROUTING -t mangle -o br-lan ! -s <TARGET_IP> -j TEE --gateway <SNIFFING_IP>
iptables -A PREROUTING -t mangle -i br-lan ! -d <TARGET_IP> -j TEE --gateway <SNIFFING_IP>

DD-WRT and Tomato firmware (to name the popular ones) are a pretty similar process. I don't recall the precise differences, but the network interface (br-lan) will probably be named differently and, depending on the version of iptables/TEE, may have slightly differently named arguments. On the plus side, this works from wireless to ethernet and vice-versa; the sniffing machine can be connected to the internet; you don't have to worry about wireless decryption; and you can sniff multiple machines at once.

Though, since you say you have no control over the router, the cheapest solution would be to have both machines wireless connected to the router, and put one in promiscuous mode (which Linux is much better at than Windows). Wireshark can usually handle the wireless decryption, but it only for simple encryption modes.

If you only have one wireless card and can't control the router, it's much simpler to just not use Wi-Fi. In this case, making an ethernet tap is a pretty cheap option. If you do this, your sniffing machine won't be able to connect to the internet while sniffing.

Back in the day, you could just use a hub, but I don't think those even exist anymore. Of course, you could force a switch into hub mode with ARP poisoning, but websites which offer ARP poisoning tools typically aren't the kinds I could link to in good conscience.

Anyway, once you have your network setup for it, the sniffing itself is just a matter of using Wireshark.

Go to: