2

With MacOSx, I am trying to run my nic in promiscuous mode and then use tshark / tcpdump to capture traffic.

Option 1:

 ifconfig en0 promisc

but I get this message:

ifconfig: promisc: bad value

Option 2:

I tried sudo tcpdump -In -i en0 host 10.0.0.2 and it didn't work too. I followed: tcpdump promiscuous mode on OSX 10.8 . 10.0.0.2 is my local host - and it prints nothing to bash:

tcpdump: listening on en0, link-type IEEE802_11_RADIO (802.11 plus radiotap header), capture size 65535 bytes
^C
0 packets captured
99 packets received by filter
0 packets dropped by kernel
0x90
  • 322

1 Answers1

2

TShark and tcpdump will put the interface into promiscuous mode unless you tell them NOT to do so with the -p flag - -p doesn't mean "promiscuous mode", it means "not promiscuous mode".

-I turns on monitor mode.

Note that if you're on a "protected" network using encryption, i.e. a network using WEP or WPA/WPA2, capture filters other than at the link layer won't work, because the packets being handed to the packet capture mechanism (BPF, in the case of OS X) do not have the payload decrypted. This means a filter such as "host 10.0.0.2" won't work.

  • what do you mean by BPF do not have the payload decrypted the key is identical to all the hosts in the network. – 0x90 Apr 30 '13 at 04:10
  • 1
    I mean that the OS will not decrypt the packets before handing it to the code that implements filters, even though it will decrypt packets sent to the host (but not packets sent to some other host) before handing them to the networking stack. Therefore, any filter expression that looks at the IP layer, such as "host 10.0.0.2", will fail. –  Apr 30 '13 at 07:11
  • So how can I sniff the packets ? – 0x90 Apr 30 '13 at 07:35
  • 2
    If you're on a WEP or WPA/WPA2 network: don't use a capture filter, make sure you capture the initial EAPOL handshakes for all hosts you care about if it's a WPA/WPA2 network, and follow these directions in Wireshark (or manually add the keys to your Wireshark preferences file if you can only use TShark). –  Apr 30 '13 at 08:31