-rw-r--r-- | noncore/net/wellenreiter/daemon/source/sniffer.c | 7 |
1 files changed, 2 insertions, 5 deletions
diff --git a/noncore/net/wellenreiter/daemon/source/sniffer.c b/noncore/net/wellenreiter/daemon/source/sniffer.c index 6f40503..31a5d13 100644 --- a/noncore/net/wellenreiter/daemon/source/sniffer.c +++ b/noncore/net/wellenreiter/daemon/source/sniffer.c | |||
@@ -1,76 +1,73 @@ | |||
1 | /* Its just a simple rfmon mode sniffer | 1 | /* Its just a simple rfmon mode sniffer |
2 | i hope my C is at last a bit better then in my | 2 | i hope my C is at last a bit better then in my |
3 | early days :-). | 3 | early days :-). |
4 | This works only with cisco wireless cards with an rfmon | 4 | This works only with cisco wireless cards with an rfmon |
5 | able driver and not with wifi stuff. | 5 | able driver and not with wifi stuff. |
6 | Btw. did i mention that i hate C? | 6 | Btw. did i mention that i hate C? |
7 | 7 | ||
8 | To compile use: | 8 | To compile use: |
9 | gcc wlan-sniffer.c -o wlan-sniffer -lpcap | 9 | gcc sniffer.c -o wlan-sniffer -lpcap |
10 | |||
11 | use it like this: | ||
12 | wlan-sniffer interface | ||
13 | 10 | ||
14 | */ | 11 | */ |
15 | #include "sniffer.h" | 12 | #include "sniffer.h" |
16 | 13 | ||
17 | int main(int argc, char **argv) | 14 | int main(int argc, char **argv) |
18 | { | 15 | { |
19 | int ret; /* return code */ | 16 | int ret; /* return code */ |
20 | ret = card_into_monitormode (SNIFFER_DEVICE, CARD_TYPE_NG); | 17 | ret = card_into_monitormode (SNIFFER_DEVICE, CARD_TYPE_NG); |
21 | if (ret == -1) | 18 | if (ret == -1) |
22 | { | 19 | { |
23 | exit(-1); | 20 | exit(-1); |
24 | } | 21 | } |
25 | start_sniffing (SNIFFER_DEVICE); | 22 | start_sniffing (SNIFFER_DEVICE); |
26 | 23 | ||
27 | return 0; | 24 | return 0; |
28 | } | 25 | } |
29 | 26 | ||
30 | int card_into_monitormode (char * device, int cardtype) | 27 | int card_into_monitormode (char * device, int cardtype) |
31 | { | 28 | { |
32 | int ret = -1; | 29 | int ret = -1; |
33 | int datalink; /* used for getting the pcap datalink type */ | 30 | int datalink; /* used for getting the pcap datalink type */ |
34 | char CiscoRFMON[35] = "/proc/driver/aironet/"; | 31 | char CiscoRFMON[35] = "/proc/driver/aironet/"; |
35 | FILE *CISCO_CONFIG_FILE; | 32 | FILE *CISCO_CONFIG_FILE; |
36 | char errbuf[PCAP_ERRBUF_SIZE]; | 33 | char errbuf[PCAP_ERRBUF_SIZE]; |
37 | pcap_t *handle; | 34 | pcap_t *handle; |
38 | 35 | ||
39 | /* Checks if we have a device to sniff on */ | 36 | /* Checks if we have a device to sniff on */ |
40 | if(device == NULL) | 37 | if(device == NULL) |
41 | { | 38 | { |
42 | printf ("Fatal error i did not have any interfaces to sniff on\n"); | 39 | printf ("Fatal error i did not have any interfaces to sniff on\n"); |
43 | exit(1); | 40 | exit(1); |
44 | } | 41 | } |
45 | 42 | ||
46 | /* Setting the prmiscous and up flag to the interface */ | 43 | /* Setting the prmiscous and up flag to the interface */ |
47 | if (card_set_promisc_up (device) == 0) | 44 | if (card_set_promisc_up (device) == 0) |
48 | { | 45 | { |
49 | printf ("Interface flags correctly set using ifconfig\n"); | 46 | printf ("Interface flags correctly set using ifconfig\n"); |
50 | } | 47 | } |
51 | 48 | ||
52 | /* Check the cardtype and executes the commands to go into monitor mode */ | 49 | /* Check the cardtype and executes the commands to go into monitor mode */ |
53 | if (cardtype == CARD_TYPE_CISCO) /* I got a cisco card */ | 50 | if (cardtype == CARD_TYPE_CISCO) /* I got a cisco card */ |
54 | { | 51 | { |
55 | /* bring the sniffer into rfmon mode */ | 52 | /* bring the sniffer into rfmon mode */ |
56 | snprintf(CiscoRFMON, sizeof(CiscoRFMON),DEFAULT_PATH, device); | 53 | snprintf(CiscoRFMON, sizeof(CiscoRFMON),DEFAULT_PATH, device); |
57 | CISCO_CONFIG_FILE = fopen(CiscoRFMON,"w"); | 54 | CISCO_CONFIG_FILE = fopen(CiscoRFMON,"w"); |
58 | fputs ("Mode: r",CISCO_CONFIG_FILE); | 55 | fputs ("Mode: r",CISCO_CONFIG_FILE); |
59 | fputs ("Mode: y",CISCO_CONFIG_FILE); | 56 | fputs ("Mode: y",CISCO_CONFIG_FILE); |
60 | fputs ("XmitPower: 1",CISCO_CONFIG_FILE); | 57 | fputs ("XmitPower: 1",CISCO_CONFIG_FILE); |
61 | fclose(CISCO_CONFIG_FILE); | 58 | fclose(CISCO_CONFIG_FILE); |
62 | } | 59 | } |
63 | else if (cardtype == CARD_TYPE_NG) | 60 | else if (cardtype == CARD_TYPE_NG) |
64 | { | 61 | { |
65 | char wlanngcmd[62]; | 62 | char wlanngcmd[62]; |
66 | snprintf(wlanngcmd, sizeof(wlanngcmd),"%s %s lnxreq_wlansniff channel=1 enable=true",WLANCTL_PATH,device); | 63 | snprintf(wlanngcmd, sizeof(wlanngcmd),"%s %s lnxreq_wlansniff channel=1 enable=true",WLANCTL_PATH,device); |
67 | if (ret = (system (wlanngcmd)) != 0) | 64 | if (ret = (system (wlanngcmd)) != 0) |
68 | { | 65 | { |
69 | printf ("\n Fatal error could not set %s in raw mode, check cardtype\n",device); | 66 | printf ("\n Fatal error could not set %s in raw mode, check cardtype\n",device); |
70 | exit(1); | 67 | exit(1); |
71 | } | 68 | } |
72 | } | 69 | } |
73 | else if (cardtype == CARD_TYPE_HOSTAP) | 70 | else if (cardtype == CARD_TYPE_HOSTAP) |
74 | { | 71 | { |
75 | printf ("Got a host-ap card, nothing is implemented now\n"); | 72 | printf ("Got a host-ap card, nothing is implemented now\n"); |
76 | } | 73 | } |
@@ -154,129 +151,129 @@ void process_packets(u_char *useless,const struct pcap_pkthdr* pkthdr,const u_ch | |||
154 | { | 151 | { |
155 | /* This is a garbage packet, because is does not long enough | 152 | /* This is a garbage packet, because is does not long enough |
156 | to hold a 802.11b header */ | 153 | to hold a 802.11b header */ |
157 | pinfoptr->isvalid = 0; | 154 | pinfoptr->isvalid = 0; |
158 | return; | 155 | return; |
159 | } | 156 | } |
160 | 157 | ||
161 | /* Gets the framecontrol bits (2bytes long) */ | 158 | /* Gets the framecontrol bits (2bytes long) */ |
162 | fc = EXTRACT_LE_16BITS(packet); | 159 | fc = EXTRACT_LE_16BITS(packet); |
163 | 160 | ||
164 | HEADER_LENGTH = GetHeaderLength(fc); | 161 | HEADER_LENGTH = GetHeaderLength(fc); |
165 | 162 | ||
166 | if (caplen < HEADER_LENGTH) | 163 | if (caplen < HEADER_LENGTH) |
167 | { | 164 | { |
168 | /* This is a garbage packet, because it is not long enough | 165 | /* This is a garbage packet, because it is not long enough |
169 | to hold a correct header of its type */ | 166 | to hold a correct header of its type */ |
170 | pinfoptr->isvalid = 0; | 167 | pinfoptr->isvalid = 0; |
171 | return; | 168 | return; |
172 | } | 169 | } |
173 | 170 | ||
174 | /* Decode 802.11b header out of the packet */ | 171 | /* Decode 802.11b header out of the packet */ |
175 | if (decode_80211b_hdr(packet,pinfoptr) == 0) | 172 | if (decode_80211b_hdr(packet,pinfoptr) == 0) |
176 | { | 173 | { |
177 | /* Justification of the ofset to further process the packet */ | 174 | /* Justification of the ofset to further process the packet */ |
178 | length -= HEADER_LENGTH; | 175 | length -= HEADER_LENGTH; |
179 | caplen -= HEADER_LENGTH; | 176 | caplen -= HEADER_LENGTH; |
180 | packet += HEADER_LENGTH; | 177 | packet += HEADER_LENGTH; |
181 | } | 178 | } |
182 | else | 179 | else |
183 | { /* Something is wrong,could not be a correct packet */ | 180 | { /* Something is wrong,could not be a correct packet */ |
184 | return; | 181 | return; |
185 | } | 182 | } |
186 | 183 | ||
187 | switch (FC_TYPE(fc)) | 184 | switch (FC_TYPE(fc)) |
188 | { | 185 | { |
189 | /* Is it a managemnet frame? */ | 186 | /* Is it a managemnet frame? */ |
190 | case T_MGMT: | 187 | case T_MGMT: |
191 | switch (FC_SUBTYPE(fc)) | 188 | switch (FC_SUBTYPE(fc)) |
192 | { /* Is it a beacon frame? */ | 189 | { /* Is it a beacon frame? */ |
193 | case ST_BEACON: | 190 | case ST_BEACON: |
194 | if (handle_beacon(fc, packet,pinfoptr) ==0) | 191 | if (handle_beacon(fc, packet,pinfoptr) ==0) |
195 | { | 192 | { |
196 | if (!strcmp(pinfoptr->desthwaddr,"ff:ff:ff:ff:ff:ff") == 0) | 193 | if (!strcmp(pinfoptr->desthwaddr,"ff:ff:ff:ff:ff:ff") == 0) |
197 | { | 194 | { |
198 | /* Every beacon must have the broadcast as destination | 195 | /* Every beacon must have the broadcast as destination |
199 | so it must be a shitti packet */ | 196 | so it must be a shitti packet */ |
200 | pinfoptr->isvalid = 0; | 197 | pinfoptr->isvalid = 0; |
201 | return; | 198 | return; |
202 | } | 199 | } |
203 | if (pinfoptr->cap_ESS == pinfoptr->cap_IBSS) | 200 | if (pinfoptr->cap_ESS == pinfoptr->cap_IBSS) |
204 | { | 201 | { |
205 | /* Only one of both are possible, so must be | 202 | /* Only one of both are possible, so must be |
206 | a noise packet, if this comes up */ | 203 | a noise packet, if this comes up */ |
207 | pinfoptr->isvalid = 0; | 204 | pinfoptr->isvalid = 0; |
208 | return; | 205 | return; |
209 | } | 206 | } |
210 | if (pinfoptr->channel < 1 || pinfoptr->channel > 14) | 207 | if (pinfoptr->channel < 1 || pinfoptr->channel > 14) |
211 | { | 208 | { |
212 | /* Only channels between 1 and 14 are possible | 209 | /* Only channels between 1 and 14 are possible |
213 | others must be noise packets */ | 210 | others must be noise packets */ |
214 | pinfoptr->isvalid = 0; | 211 | pinfoptr->isvalid = 0; |
215 | return; | 212 | return; |
216 | } | 213 | } |
217 | 214 | ||
218 | /* Decoding successfull of beacon frame */ | 215 | /* Here should be the infos to the gui issued */ |
219 | if (pinfoptr->cap_ESS == 1 &&pinfoptr->cap_IBSS ==0) | 216 | if (pinfoptr->cap_ESS == 1 &&pinfoptr->cap_IBSS ==0) |
220 | { | 217 | { |
221 | printf ("\nHave found an accesspoint:"); | 218 | printf ("\nHave found an accesspoint:"); |
222 | } | 219 | } |
223 | else if(pinfoptr->cap_ESS == 0 && pinfoptr->cap_IBSS == 1) | 220 | else if(pinfoptr->cap_ESS == 0 && pinfoptr->cap_IBSS == 1) |
224 | { | 221 | { |
225 | printf ("\nHave found an AD-HOC station:"); | 222 | printf ("\nHave found an AD-HOC station:"); |
226 | 223 | ||
227 | } | 224 | } |
228 | if (strcmp (pinfoptr->ssid,NONBROADCASTING) ==0) | 225 | if (strcmp (pinfoptr->ssid,NONBROADCASTING) ==0) |
229 | { | 226 | { |
230 | printf ("\n\tOn a non-broadcasting network"); | 227 | printf ("\n\tOn a non-broadcasting network"); |
231 | } | 228 | } |
232 | else | 229 | else |
233 | { | 230 | { |
234 | printf ("\n\tOn network : %s",pinfoptr->ssid); | 231 | printf ("\n\tOn network : %s",pinfoptr->ssid); |
235 | } | 232 | } |
236 | printf ("\n\tLen SSID : %d",pinfoptr->ssid_len); | 233 | printf ("\n\tLen SSID : %d",pinfoptr->ssid_len); |
237 | printf ("\n\tOn Channel : %d",pinfoptr->channel); | 234 | printf ("\n\tOn Channel : %d",pinfoptr->channel); |
238 | printf ("\n\tEncryption : %s", pinfoptr->cap_WEP ? "ON" : "OFF"); | 235 | printf ("\n\tEncryption : %s", pinfoptr->cap_WEP ? "ON" : "OFF"); |
239 | printf ("\n\tMacaddress : %s",pinfoptr->sndhwaddr); | 236 | printf ("\n\tMacaddress : %s",pinfoptr->sndhwaddr); |
240 | printf ("\n\tBssid : %s",pinfoptr->bssid); | 237 | printf ("\n\tBssid : %s",pinfoptr->bssid); |
241 | printf ("\n\tDest : %s\n",pinfoptr->desthwaddr); | 238 | printf ("\n\tDest : %s\n",pinfoptr->desthwaddr); |
242 | } | 239 | } |
243 | break; | 240 | break; |
244 | default: | 241 | default: |
245 | printf("Unknown IEEE802.11 frame subtype (%d)",FC_SUBTYPE(fc)); | 242 | printf("Unknown IEEE802.11 frame subtype (%d)",FC_SUBTYPE(fc)); |
246 | break; | 243 | break; |
247 | } /* End of switch over different mgt frame types */ | 244 | } /* End of switch over different mgt frame types */ |
248 | 245 | ||
249 | break; | 246 | break; |
250 | case T_CTRL: | 247 | case T_CTRL: |
251 | //decode_control_frames(fc, packet); | 248 | //decode_control_frames(fc, packet); |
252 | printf ("Its a control frame"); | 249 | printf ("Its a control frame"); |
253 | break; | 250 | break; |
254 | case T_DATA: | 251 | case T_DATA: |
255 | //decode_data_frames(fc, packet); | 252 | //decode_data_frames(fc, packet); |
256 | printf ("Its a date frame"); | 253 | printf ("Its a date frame"); |
257 | break; | 254 | break; |
258 | default: | 255 | default: |
259 | printf("Unknown IEEE802.11 frame type (%d)",FC_TYPE(fc)); | 256 | printf("Unknown IEEE802.11 frame type (%d)",FC_TYPE(fc)); |
260 | break; | 257 | break; |
261 | } | 258 | } |
262 | } | 259 | } |
263 | 260 | ||
264 | 261 | ||
265 | /* This decodes the 802.11b frame header out of the 802.11b packet | 262 | /* This decodes the 802.11b frame header out of the 802.11b packet |
266 | all the infos is placed into the packetinfo structure */ | 263 | all the infos is placed into the packetinfo structure */ |
267 | int decode_80211b_hdr(const u_char *p,struct packetinfo *ppinfo) | 264 | int decode_80211b_hdr(const u_char *p,struct packetinfo *ppinfo) |
268 | { | 265 | { |
269 | char * ret; | 266 | char * ret; |
270 | char testme[16]; | 267 | char testme[16]; |
271 | const struct mgmt_header_t *mgthdr = (const struct mgmt_header_t *) p; | 268 | const struct mgmt_header_t *mgthdr = (const struct mgmt_header_t *) p; |
272 | ppinfo->fcsubtype = FC_SUBTYPE(mgthdr->fc); | 269 | ppinfo->fcsubtype = FC_SUBTYPE(mgthdr->fc); |
273 | 270 | ||
274 | /* Get the sender, bssid and dest mac address */ | 271 | /* Get the sender, bssid and dest mac address */ |
275 | etheraddr_string(mgthdr->bssid,ppinfo->bssid); | 272 | etheraddr_string(mgthdr->bssid,ppinfo->bssid); |
276 | etheraddr_string(mgthdr->da,ppinfo->desthwaddr); | 273 | etheraddr_string(mgthdr->da,ppinfo->desthwaddr); |
277 | etheraddr_string(mgthdr->sa,ppinfo->sndhwaddr); | 274 | etheraddr_string(mgthdr->sa,ppinfo->sndhwaddr); |
278 | ppinfo->fc_wep = FC_WEP(mgthdr->fc); | 275 | ppinfo->fc_wep = FC_WEP(mgthdr->fc); |
279 | return(0); | 276 | return(0); |
280 | } | 277 | } |
281 | 278 | ||
282 | 279 | ||