我目前正试图在Ubuntu20.04.3LTS上用libpcap设置一个简单的数据包嗅探器,但在使用pcap_set_rfmon()设置监控模式时遇到了很多困惑。我使用的代码和编译命令的修剪版本如下:
g++ trimsniff.cc -g -o tsniff -L/usr/local/lib -lpcap
代码:
#include <iostream>
#include <pcap/pcap.h>
#include <string>
#include <cstdlib>
#include <cstring>
using namespace std;
int main(int argc, char *argv[])
{
//Declare needed variables
const int MAX_NAME_LEN = 20;
char errbuf[PCAP_ERRBUF_SIZE];
char dev[MAX_NAME_LEN];
pcap_if_t *alldevs;
pcap_if_t *alldevsp;
pcap_t * handle;
//Check Libpcap version number
cout << pcap_lib_version() << endl << endl;
//Initialize the library for local charactr encoding & error check
if(pcap_init(PCAP_CHAR_ENC_LOCAL, errbuf))
{
fprintf(stderr, "Couldn't Initialize pcap; %s\n", errbuf);
}
else
{
cout << "PCAP Successfully Initialized" << endl << endl;
}
//trimmed version of device selection code, this assumes an
//available device was specified in the command line call
//(I make sure of this in the full code without error)
strcpy(dev, argv[1]);
cout << endl << "Selected Device: " << dev << endl << endl;
//Open device for sniffing
handle = pcap_create(dev, errbuf);
//Try setting monitor mode and error check, trimmed down to the error I'm facing
int mm_set = pcap_can_set_rfmon(handle);
if(mm_set==0)
{
fprintf(stderr, "Error setting monitor mode: Device doesn't have MM capability\n");
}
else
{
if(!pcap_set_rfmon(handle,1))
{
cout << "Monitor Mode Enabled, pcap_set_rfmon(...) == 0" << endl;
}
}
cout << endl;
//Using pcap_set_rfmon() here to illustrate issue, this will output a 0
//indicating success but the pcap_activate() error check contradicts this
cout << pcap_set_rfmon(handle,1) << endl;
//Activate the interface for sniffing
if(pcap_activate(handle))
{
cout << endl;
pcap_perror(handle,"Error");
cout << endl;
pcap_set_rfmon(handle,0);
pcap_activate(handle);
}
pcap_close(handle);
return 0;
}
我的设备当然能够监控模式,因为我在过去成功地使用了终端命令和aircrack-ng来监控不相关的网络流量。
但是,当我尝试使用libpcap函数时,pcap_set_rfmon()将返回0,就好像它成功了一样,而pcap_can_set_rfmon()与此相反,返回0表示不能设置监控模式。下面是我修剪过的代码的输出,带零的那一行是pcap_set_rfmon()的输出,表示成功。
libpcap version 1.11.0-PRE-GIT (with TPACKET_V3)
PCAP Successfully Initialized
Selected Device: wlx00c0caadea0a
Error setting monitor mode: Device doesn't have MM capability
0
Error: That device doesn't support monitor mode
最后一个错误消息来自调用pcap_activate() (使用libpcap错误打印函数pcap_perror() ),在尝试使用pcap_set_rfmon()设置监控模式之后。
有人知道这个矛盾是从哪里来的和/或如何解决它吗?
发布于 2021-10-29 16:19:25
环顾四周,这显然是基于Linux的系统的问题。Libpcap需要链接libnl来正确设置pcap_set_rfmon()
的监控模式,但这不会发生,可能是因为libnl库的版本冲突。这个功能在我的苹果电脑上可以很好地设置监控模式,但在Ubuntu中,我必须通过ip link
和iw
控制台命令使用system()
函数作为变通办法。只要事先做一些OS检测,让您的程序决定使用哪种方法是微不足道的。
https://stackoverflow.com/questions/69578623
复制相似问题