1

I have been using nemesis for forging fake DHCP request packets on my Ubuntu machine. I get a "packet injected" message each time I inject it. However I was not able to analyze it on wireshark as my packet in not being shown there. Nor do I get any reply packets from server. I am using the correct payload extracted from valid DHCP requests. What might be the problem.

7
  • Are you capturing the DHCPrequest packets before injecting or are you creating completely new "false" packets?
    – Yokai
    May 14, 2016 at 15:14
  • I was replaying a true packet produced during normal WiFi connection procedure
    – Sunny
    May 14, 2016 at 15:17
  • That is odd. I have never had that happen for me before. I'll search around the net and see if this is a bug with Nemesis or Wireshark and get back to you.
    – Yokai
    May 14, 2016 at 15:18
  • Ethernet or wireless?
    – Yokai
    May 14, 2016 at 15:21
  • Oh thats right you said wifi. In that case is your interface in monitor mode or promiscuous mode?
    – Yokai
    May 14, 2016 at 15:23

1 Answer 1

1

Okay with my first test, I used etherape GUI to show what types of packets were being sent when I replayed the injected packet. What I saw was the color code for "UDP UNKNOWN" which leads me to believe it is a possible issue with Nemesis itself. In wireshark, there was no response from my router as a result of replaying the packet.

Subsequent tests using specific filters in wireshark as well as tcpdump are still showing zero results after replaying injected packet. I read over the nemesis changelog and it seems it has had injection issues in the past.

May have to report this as a bug in Nemesis even though I am not sure if the tool is even being maintained any longer. hate to say it but I don't think I'll be able to figure this one out. And that sucks.

5
  • You said "In wireshark, there was no response from my router". So you were able to catch the sent packet only in etherape(not in wireshark or tcpdump)?
    – Sunny
    May 14, 2016 at 17:01
  • I didn't catch any response in wireshark or tcpdump but I was able to view my sending it in etherape, yeah. Tcpdump showed the send as well. I got some sent DHCPv6 packets outgoing in wireshark but nothing incoming.
    – Yokai
    May 14, 2016 at 17:18
  • Well, I couldn't even catch the sent packet in wireshark. Where you connected to the network during the sending?
    – Sunny
    May 14, 2016 at 17:40
  • I tried before connecting and after. Same results both times for me.
    – Yokai
    May 14, 2016 at 17:47
  • Sarcastic kudos to the moderator that deleted my very relevant answer post that had some legit possible solutions to the problem. Great job moderator, great gob... Anti-answer my asscheek. I didn't see you giving any kind of solution suggestions +schroeder
    – Yokai
    May 15, 2016 at 8:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .