Ubuntu Networking :: Any Software For Wireless Packet Capture?
May 29, 2010Does ubuntu have anything similar to window's program Cain & Abel for wireless packet capture?
View 1 RepliesDoes ubuntu have anything similar to window's program Cain & Abel for wireless packet capture?
View 1 RepliesI am the new user to ns-2. I would like to know is it possible to send the keys or some value as the packet data (content of the packet) in ns-2 (for wireless environment).
View 1 Replies View RelatedI'm running ubuntu 11.04, and using firestarter for my firewall. Logging events, all good, but I'd like to be able to (tcp)dump the packets being dropped/rejected. Wireshark is great after the event, but can I hook iptables and tcpdump together somehow so the system logs the entire packet rather than the summary when it says "no"? I've had a quick look/google, but can't find anything. I'm sure somebody must have wanted to do this before - any pointers people?
PS - will keep looking and post the answer if I find one....
I wanna capture network packets from DMA ring buffer, just like netfilter. i wanna capture it from DMA, because i wanna get MAC address of I/O packets, so netfilter not included MAC address of out going packets because its on IP level and Ebtables is like that too. how i can capture network packets from DMA ring buffer.
View 9 Replies View RelatedJust want to know if my connection will be good for voip like skype...
View 1 Replies View RelatedI have ubuntu lucid running on Dell 230 PC, linksys WPN600 N wireless PCI network card connecting to a Cisco E3000 dual channel router.
Kernel: 2.6.32-33-generic
Installed Ralink driver v2.4.0.0
iwconfig shows that the bit rate is 130Mb/s and link quality is 98/100. I'm using the wcid network manager instead of defaul gnome one. I'm getting lots of packet loss and performance is very bad. The connection is practically unusable. I've tried installing the compat wireless backport package but that did not work at all.
I am running Slackware 13.0 on a old dell dimension 4500. The install went fine. sound worked, graphics where good. Everything was going perfect. until i worked on wireless.i have a realtek rtl8185 wireless chipset card. I got the wireless. Linux wireless driver. It worked on both Mint 5.0 and backtrack 4.0.so I untar the file. cd to the dir and type make then make install and reboot. like I have always done.
I was having to fight with wpa_gui and finally got it working but then it would go in and out on the connect and disconnect feature. so I tried using iwconfig. did not get muc luck with that either so i installed wicd and finally got a ip address after fighting with it would give me in a ping like 75% packet loss. so I read a lot of post and try to find stuff before I post. and while reading I learned that you guys normally ask for info on the hardware and software so here you go. but I will say first that I read about adjusting the mtu to fix packet loss, I showed some of the changes I made in it around the pings I know it is a mess I am sorry I tried to make it readable. if you need more information let me know. I cant get online using a web browser or if I can only for one or two pages. any help would be great. thank you.
Code:
bash-3.1# ifconfig
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
[Code]...
I am recently trying to get a steady wireless connection running. I am currently using the default settings/driver Fedora 13 is stocked with. As my internet browsing is somewhat up and down in load times, I decided to check in a video game which is generally a good test for me. haha I am harshly spiking and cannot find the source of my problem so my guess is a driver issue.
lspci | grep Network:
Code:
Code:
It is is seemingly right, my Windows 7 harddrive works just fine, this is just one last of the few issues I'm having from fully formatting my winblows HD to use as Linux storage.
I cannot find any native AR5008 Linux Drivers for my card and it has been a frustrating day. I guess I'm not cut to be a network analyst just yet.
System specs:
ASUS P5Q SE/R
Intel Core 2 Quad Q9550
4GB DDR2 667
Gigabyte GTX465 1G
TP LINK TL-WN851N Wireless card
I am trying to get an arp packet from my wireless wifi router (access point), to which I am not connected. I simply tried ping 192.168.0.1, but the answer was connect: network is unreachable. What can I do about that?
View 1 Replies View RelatedI got a problem with my CentOS server. Somebody told me OpenVPN Requires different changes inside my firewall settings. That could be the problem why openvpn wont load..I receive this error on my CentOS panel when im trying to connect into the centos openvpn (with my winxp pc):
Thu Sep 17 20:31:36 2009 TLS Error: incoming packet authentication failed from 84.xx.62.122:2622
Thu Sep 17 20:31:38 2009 Authenticate/Decrypt packet error: packet HMAC authentication failed
Thu Sep 17 20:31:38 2009 TLS Error: incoming packet authentication failed from 84.xx.62.122:2622
[code]....
I have the latest version of aircrack, and the latest compat-wireless package installed. When I try to inject I get this:
linux08:/usr/local/sbin # ./aireplay-ng -9 wlan0
16:46:33 Trying broadcast probe requests...
16:46:35 No Answer...
16:46:35 Found 0 APs
I know for a fact that there are 2 AP's. This worked perfectly with my old laptop with a D-link PCMCIA card.
[Code]...
What is the best analogue capture program please to capture Austar.
View 1 Replies View RelatedI have 3 Dell Precision M4400 machines. After getting updates yesterday or today, I get random network dropouts like crazy, on wired or wireless. On one machine I was able to turn off ipv6 in grub and reboot, and it works now. However on the other 2 machines, still have the same problems. All 3 are running 9.10 64 bit. Is there a way I can back out the updates so the network works again? Anyone else see this behavior after updates today?
View 2 Replies View RelatedI am in a hub(with switches and rooters) and i want to spy what packets everyone receives! if can i do this and if i can which tools i can use?
View 6 Replies View RelatedI am just starting my adventure into Ubuntu. After installing and configuring Shrew Soft in Ubuntu 10.04 64Bit, I am having some serious packet loss issues. The LAN is wireless, however the only packet loss I experience is over the tunnels. I have tried different algorithms, and it seems as I fiddle with the MTU client side, it clears a bit, but the best I have managed is 23% loss average.
View 2 Replies View RelatedI am trying to simply address translate TCP packets from one destination IP to another destination IP (DNAT?) without getting the initial SYN packet. Is this possible? I do not think it is with DNAT since the conntrack needs SYN first.
I have given the command:
The problem is that the first packet that matches this rule will be the SYN-ACK and I suspect it is simply DROPPED.
I am sparing you the gory details of why I would do such a silly thing, but simply put; I need to intercept client-to-server packets through a tunnel, but allow server-to-client packets to follow through the regular network.
I have been working on this for many days w/o success and my learning curve is still steep. I can provide more details as needed.
My question is about the raw MX reply package structure. I've read the RFC and all relevant pages I could find, but I couldn't figure this one out. Say we do a google.com MX query.
The first answer (just the rdata part) will be: google.com.s9b2.psmtb.com But in the raw package, instead of the .com, you have c0 13. Then for the second answer, google.com.s9b1.psmtb.com, the raw package has, instead of psmtb.com, just c0 3a. So is the part after c0 a pointer towards another part of the message? Or what does it stand for exactly? I am puzzled by it, and don't know exactly where to ask... some of the networking people here might have a good idea.
From all the stuff that can enter an interface, how does it know when an IP packet has been *formed*? What if it's just random garbage entering there for whatever reason? Also, can Linux do other protocols besides TCP/IP? This would be the problem, as I said above.
View 2 Replies View RelatedIn application udp port listening with 3330 i am sending udp request from port 0.0.0.0:3330 to 0.0.0.0:3330 that is same port in the same machine....application works fine udp sending and receiving also fine.....for clarification ....is there any conflicts in the communication ?
View 2 Replies View RelatedI manage a small home network of 5-6 PCs and other devices. One of the PCs is used as a multipurpose server, as well as the gateway to outside.
Sometimes, I need to know what traffic goes in/out of my network (for troubleshooting, etc).
Is there a quick and dirty way to forward a copy of all the packets on the external interface to my own ip when I want to?
I got a new X201 which is running Ubuntu 10.04. While at home, everything is fine, at work, I encounter some issues with wireless. the signal cuts in and out repeatedly.Here's the output of ping. I set it to ping a server every 90 seconds, 10 times. So this is a snapshot of 15 minutes of network activity...
Code:
PING (REDACTED) bytes of data.
64 bytes from (REDACTED): icmp_seq=1 ttl=252 time=1.50 ms
64 bytes from (REDACTED): icmp_seq=2 ttl=252 time=2.13 ms
64 bytes from (REDACTED): icmp_seq=3 ttl=252 time=1.38 ms
[code]....
Also I tried this (from a 2 year old thread which was most relevant solution I could find):
Code:
Changing AVAHI_DAEMON_DETECT_LOCAL=1 to AVAHI_DAEMON_DETECT_LOCAL=0 in /etc/default/avahi-daemon has got rid of the irritating pop-up. Basically, every 5 minutes or so, for a solid 60 seconds or so I get no signal. I've tried updating the kernel, and doing apt-get remove avant-daemon, but still have problems.
enable packet injection on ubuntu. My card was perfectly running fine(though monitor mode and packet injection not working).I had got bcm-sta wireless drivers installed.
When i run lspci --nn command, i found out my driver to be as below::
Code:
Network controller [0280]: Broadcom Corporation Device [14e4:4727] (rev 01)
when i run " airmon-ng "
it displays
[Code].....
I need to get packet injection working desperately. Also , do i need to patch my drivers or something like that?
I would like to pose is very specific to a system I'm assembling. I have ask for assistance from other forums and people, however the answers receive were too vague to implement.
As for my background, I am a network user able to write TCP Linux client/server applications quite easily. At a Linux system level I do not understand the necessary combination of applications and services to affect the following;
Network components;
- WiFi access point/router with four ethernet ports
- Laptop (user computer) cabled directly into the access point via a physical cable
- Second computer running Ubuntu 10.04, with one WiFi (wlan0) and one ethernet (eth0) interface. Eth0 is configured as a DHCP server with the following;
IPaddress 192.168.252.1
broadcast 255.255.255.0
Eth0 is physically connected to an IP camera via a Cross-over cable. The camera is configured as a DHCP client. This connection works perfectly from the Linux box with a KVM attached.
Wlan0 is connected wirelessly to the access point and the Laptop can access the Linux box and vice versa.
My objective is to have the
- Laptop via the access point/router connect directly to the IP camera on the Linux box via the wireless link.
- I would prefer not to make any configuration or routing changes/entries on the access point/router.
The type of response I'm looking for;
- is this possible at a macro level
- what facilities/server are required on the Linux box (I would like all configuration applied to this computer only)
- what commands need to be executed and in what order. If possible a brief explanation of why the command is needed and where it fits in the grand scheme of the solution.
This is probably a gigantic request outside what the forum usual activity.
I have a machine with two network cards running linux mint 8 XFCE (which is compatable with Ubuntu Intrepid Ibex). eth0 gos out onto the network propper, has a static IP address of 10.10.10.10 and serves DHCP requests for the 10.10.10.x subnet.
eth1 is pluged into a PPPoE concentrator, and has a static address of 192.168.0.1 (I would have left it alone but pppoeconf wouldn't work unless it had an address).
ppp0 is the piont to piont over ethernet conection that is corectly created when I run pon. I have both guard dog and guide dog installed but they are both disabled.
Now, the weird part: I can ping the IP number of the machine at the other end of the pppoe conection (when it changes I can still ping the new number), the local IPs (10.10.10.x), but *nothing* else not even the DNS servers passed to the machine during ppp conection which are in the same sub net as the machine I can ping.
When I try to ping or trace the route I get an error message like: reply from 10.10.10.10: desination unreachable There is nothing wrong with the network at the other end, as I can make an Identical PPPoE connection from other machines on the network if the the concentrator is pluged into the hub (a rather unsafe place for it to be) and it all just falls into place.
What seems to be happening is that the machine is treating eth0 rather than ppp0 as the internet gateway, and passing the packets round in circles.
I wrote a program for transmitting an UDP Packet. It is properly received in Fedora core 2 machine while its not received properly in Fedora 12. I tried using Wireshack packet capture software which shows the protocol as DIS. Is there any service or setting i need to do for identifying the packet as UDP.
View 2 Replies View Relatedhow to identify the icmp packets & marking. this below icmp packets marking is not working.
iptables -t mangle -A PREROUTING -p icmp -j MARK --set-mark 0x5
iptables -t mangle -A PREROUTING -p icmp -j RETURN
with the help of port no or any other how can i identify the icmp packet ?... This below two is working fine
iptables -t mangle -A PREROUTING -p tcp -j MARK --set-mark 0x2
iptables -t mangle -A PREROUTING -p tcp -j RETURN
iptables -t mangle -A PREROUTING -p udp -j MARK --set-mark 0x3
iptables -t mangle -A PREROUTING -p udp -j RETURN
I need to know how a data packet is transmitted from the sender to the receiver passing through the five Internet layers. Specially what device (hardware) the data packets have to pass through at each layer before reaching the destination in a LAN.
View 2 Replies View RelatedHow can i send udp packet to the DNS using netcat in opensuse.
View 7 Replies View RelatedI am simulating a TCP/FTP to TCP/FTP network and trying to monitor the packet loss.
I am able to monitor and graph data regarding the TCPSinks' bytes received, but I can't monitor packet loss.
Why is it that the TCPSink Agent has a variable for bytes (bytes_) but not one for monitoring packet loss?
Do I have to monitor the packet loss from the queue? If so, how do I write code for this?
Below is part of the code for monitoring bytes received from sinks if anyone was interested.
I have 2 Ubuntu boxes sitting in the same subnet; server 1 [130.15.6.68] and server 2 [130.15.6.69] What I am trying to achieve here is the following: server 1 act as a gateway or proxy to server 2, meaning that server 1 is exposed to the Internet and all traffic to server 2 should go though it (i hope!).
server 2 act as application server and I don't want a direct access to it from the internet. I want all the inbound traffic comes through server 1. for testing purposes, i will limit the traffic to simple http or port 80
in server 1, i have done the following settings: iptables -t nat -A PREROUTING -p tcp -i eth0 -d 130.15.6.68 --dport 80 -j DNAT --to 130.15.6.69:80 iptables -A FORWARD -p tcp -i eth0 -d 130.15.6.69 --dport 80 -j ACCEPT In server 1, I've edited the value of net.ipv4.ip_forward to equal 1 (uncomment that line in /etc/sysctl.conf) Currently, both server 1 and server 2 has its own apache2 servers with different index.html files. the problem is, when i browse to server 1, I am still seeing its index page rather than being forwarded to the index page of server 2. how can i achieve the traffic forwarding from server 1 to server 2 when my browser pointing to server 1?