Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite

I've started working with ettercap and ARP-poisoning; however, I've sumbled upon some problems. I've executed the following command: 

ettercap -i wlan0 -w log -T -M arp:remote /192.168.1.254/ /192.168.1.0-84,86-253,255/

192.168.1.254 is the gateway, 192.168.1.85 is my own internal IP address.
It starts sniffing but I'm not receiving any packets, I've tried to capture my own traffic which works.
What's the problem? I've specified ip_forwarding using echo 1 >> /proc/sys/net/ipv4/ip_forward .

Thanks in advance.

share|improve this question
Can you inspect the target arp cache to see if the arp poison actually worked? – Dog eat cat world Nov 11 '11 at 23:17

1 Answer

up vote 2 down vote

It depends on your WiFi chip. Some chips to not support promiscuous mode. For many chips, you can get special drivers that enable promiscuous mode. You can search on the aircrack-ng for drivers that support your chip, or you can get a $10 USB WiFi device that works better.

share|improve this answer
I've got a RaLink 2860 chipset, if I'm not mistaken I think RaLink makes some pretty decent chipsets. I couldn't find any information about it on this site though. Do I have to put my interface in monitor mode for this to work? I thought it only applied when cracking networks and I didn't find anything when I read the documentation for ettercap. I'll give it a try nevertheless. Thanks for answering. – Griffin Nov 11 '11 at 16:14
Unfortunately some good chipsets aren't supported, while some cheap ones are. As Robert says you just need to find the right ones. – Rory Alsop♦ Nov 11 '11 at 16:58
Alright, thanks to you both. I'll see if I can get my hands on a supported chipset and try again. – Griffin Nov 11 '11 at 19:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.