0

I am trying to sniff interface with name tap0. However the interface does not have assigned IP address because I have it on virtual network.

When I try code I appended below, it sniffs all of the packets but on wrong interface (enp30s0) and none from the tap0 interface. I am capturing packets with wireshark and none of sniffed packets are from tap0 interface.

The question is : how do I sniff only tap0 even though it does not have assigned IP address ?

#define DEFAULT_IF  "tap0"
char ifName[IFNAMSIZ];
int broad = 1;
strcpy(ifName, DEFAULT_IF);
sockaddr_ll sAd;
struct ifreq if_idx2;
memset(&if_idx2, 0, sizeof(struct ifreq));
strcpy(if_idx2.ifr_name, ifName);
if (ioctl(sockfd, SIOCGIFINDEX, &if_idx2) < 0)
    perror("SIOCGIFINDEX");
sAd.sll_family = AF_PACKET;
sAd.sll_protocol = IPPROTO_UDP;
sAd.sll_ifindex = if_idx2.ifr_ifindex;
sAd.sll_pkttype = PACKET_BROADCAST;
memset(sAd.sll_addr,0xff,8);
bind(sockfd,(sockaddr *)&sAd, sizeof(sAd));
setsockopt(sockfd, SOL_SOCKET, SO_BROADCAST,&broad,sizeof(int));
int pocet =0;
for(int i =0 ; i<128;i++) {
    unsigned char bufferik[342];
    memset(bufferik, 0, sizeof(char) * 342);
    socklen_t slen = sizeof(sAd);
    recvfrom(sockfd, bufferik, 342, 0,(sockaddr *)&sAd,&slen);
    for (int i = 0; i < 342; i++)
        printf("%02x ", bufferik[i]);
    cout << endl<< endl;
    if (bufferik[1] == 0x10){
        cout<< "success finding DHCP packet" <<endl;
        for (int j = 0; j < 342; j++)
            printf("%02x ", bufferik[j]);
        pocet++;
    }
}
cout<<pocet<<endl;
Hynek Bernard
  • 744
  • 1
  • 11
  • 30
  • 1
    Google "promiscuous mode". – Jesper Juhl Mar 26 '18 at 18:10
  • promiscuous mode is allowed on the interface, could you please be more specific ? – Hynek Bernard Mar 26 '18 at 18:15
  • 1
    Nope. Was just providing a pointer to one potential roadblock.. – Jesper Juhl Mar 26 '18 at 18:17
  • 1
    This is C++ code that appears to be using an unseen `using namespace std;` statement, so make sure that the `bind()` statement is actually calling the socket [`bind()`](http://man7.org/linux/man-pages/man2/bind.2.html) function and not the STL [`std::bind()`](http://en.cppreference.com/w/cpp/utility/functional/bind) function. Either don't use `using namespace std;` (it is [bad practice](https://stackoverflow.com/questions/1452721/) anyway), or qualify the `bind()` call as `::bind()`. This has bitten socket developers who are noobs to C++ many times. – Remy Lebeau Mar 26 '18 at 21:05

0 Answers0