0

I'm simulating Driftnet (using Kali Linux) on VMware Workstation.

I do an ARP poisoning MITM attack first to capture all the packets between two virtual machines (both Windows), then I open Driftnet.

When I capture images sent from one VM to another only part of the image gets captured. I've tried many images of different sizes, it's always the same.

Example: I'm sending this image from one VM to the otherenter image description here

And here is the captured image:

enter image description here

The image is always cut off at the same place no matter how often I do it.

Improve this question
2
  • 2
    just send the image a second time upside down, problem solved!
    – daniel
    Commented Jun 13, 2017 at 22:11
  • sounds like a hardware or memory limitation
    – schroeder ♦
    Commented Jun 14, 2017 at 6:30

1 Answer 1

Reset to default
1

I believe Driftnet has implementation limitations which keep it from re-assembling the entire image sequence of packets. It detects the first packet containing what it recognizes as an image header, but doesn't follow the entire stream of packets to completely capture the image.

There is most likely a fixed-size buffer, or max count of data packets per image. Is it the same relative percentage of all images, or does a smaller image (smaller in total size then the size of the truncated flower image) pass through completely?

Improve this answer
2
  • Yes. I tried much smaller images and it's still the exact same problem. The same percentage of the image gets captured as the flower. So what could be the problem?
    – Leftover
    Commented Jun 14, 2017 at 16:15
  • Same percentage of the smaller image sounds like a bug in driftnet, either in the capture code, or the display code. You may have to go digging in the source.
    – JesseM
    Commented Jun 14, 2017 at 20:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .