5

I've started working with ettercap and ARP-poisoning; however, I've stumbled upon some problems. I've executed the following command: 

ettercap -i wlan0 -w log -T -M arp:remote /192.168.1.254/ /192.168.1.0-84,86-253,255/

192.168.1.254 is the gateway, 192.168.1.85 is my own internal IP address.
It starts sniffing but I'm not receiving any packets, I've tried to capture my own traffic which works.
What's the problem? I've specified ip_forwarding using echo 1 >> /proc/sys/net/ipv4/ip_forward.

|improve this question
  • Can you inspect the target arp cache to see if the arp poison actually worked? – Dog eat cat world Nov 11 '11 at 23:17
  • Just because it supports mon mode doesn't mean it's actually in mon mode. I would start with that. Also it's likely channel hoping by default. You want to focus on a channel as well. – Anthony Russell May 27 '15 at 13:07
  • @Mast, when editing a post, I encourage you to fix every problem you can. Don't just remove "Thanks" without fixing other problems. For instance, there was an opportunity to correct the spelling of "sumbled" and to remove the training period at the end of the post. See meta.stackexchange.com/q/74430/160917. Thank you for listening, and for taking your time to improve posts here! – D.W. Apr 3 '17 at 21:15
  • @D.W. Agreed. Keep in mind that edit was almost 2 years ago, I learned a lot about the SE network since then :-) – Mast Apr 3 '17 at 21:30
3

It depends on your WiFi chip. Some chips to not support promiscuous mode. For many chips, you can get special drivers that enable promiscuous mode. You can search on the aircrack-ng for drivers that support your chip, or you can get a $10 USB WiFi device that works better.

|improve this answer
  • I've got a RaLink 2860 chipset, if I'm not mistaken I think RaLink makes some pretty decent chipsets. I couldn't find any information about it on this site though. Do I have to put my interface in monitor mode for this to work? I thought it only applied when cracking networks and I didn't find anything when I read the documentation for ettercap. I'll give it a try nevertheless. Thanks for answering. – Griffin Nov 11 '11 at 16:14
  • 2
    Unfortunately some good chipsets aren't supported, while some cheap ones are. As Robert says you just need to find the right ones. – Rory Alsop♦ Nov 11 '11 at 16:58
  • Alright, thanks to you both. I'll see if I can get my hands on a supported chipset and try again. – Griffin Nov 11 '11 at 19:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.