I have been using nemesis for forging fake DHCP request packets on my Ubuntu machine. I get a "packet injected" message each time I inject it. However I was not able to analyze it on wireshark as my packet in not being shown there. Nor do I get any reply packets from server. I am using the correct payload extracted from valid DHCP requests. What might be the problem.

  • Are you capturing the DHCPrequest packets before injecting or are you creating completely new "false" packets? – Yokai May 14 '16 at 15:14
  • I was replaying a true packet produced during normal WiFi connection procedure – Sunny May 14 '16 at 15:17
  • That is odd. I have never had that happen for me before. I'll search around the net and see if this is a bug with Nemesis or Wireshark and get back to you. – Yokai May 14 '16 at 15:18
  • Ethernet or wireless? – Yokai May 14 '16 at 15:21
  • Oh thats right you said wifi. In that case is your interface in monitor mode or promiscuous mode? – Yokai May 14 '16 at 15:23

Okay with my first test, I used etherape GUI to show what types of packets were being sent when I replayed the injected packet. What I saw was the color code for "UDP UNKNOWN" which leads me to believe it is a possible issue with Nemesis itself. In wireshark, there was no response from my router as a result of replaying the packet.

Subsequent tests using specific filters in wireshark as well as tcpdump are still showing zero results after replaying injected packet. I read over the nemesis changelog and it seems it has had injection issues in the past.

May have to report this as a bug in Nemesis even though I am not sure if the tool is even being maintained any longer. hate to say it but I don't think I'll be able to figure this one out. And that sucks.

| improve this answer | |
  • You said "In wireshark, there was no response from my router". So you were able to catch the sent packet only in etherape(not in wireshark or tcpdump)? – Sunny May 14 '16 at 17:01
  • I didn't catch any response in wireshark or tcpdump but I was able to view my sending it in etherape, yeah. Tcpdump showed the send as well. I got some sent DHCPv6 packets outgoing in wireshark but nothing incoming. – Yokai May 14 '16 at 17:18
  • Well, I couldn't even catch the sent packet in wireshark. Where you connected to the network during the sending? – Sunny May 14 '16 at 17:40
  • I tried before connecting and after. Same results both times for me. – Yokai May 14 '16 at 17:47
  • Sarcastic kudos to the moderator that deleted my very relevant answer post that had some legit possible solutions to the problem. Great job moderator, great gob... Anti-answer my asscheek. I didn't see you giving any kind of solution suggestions +schroeder – Yokai May 15 '16 at 8:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.