Whistle Master Posted January 3, 2016 Share Posted January 3, 2016 Module: tcpdump Version: 1.4 Features: Manage dependencies Configure tcpdump options and filters Dump History Change log: 1.4 Bug fixes Link to comment Share on other sites More sharing options...
Purrball Posted January 22, 2016 Share Posted January 22, 2016 This is probably a stupid question but im not too familiar with tcpdump... which interface should be the appropriate choice for watching inbound traffic? (And not capturing everything you do while browsing through the NANO interface) Link to comment Share on other sites More sharing options...
M47H3W Posted January 22, 2016 Share Posted January 22, 2016 This is probably a stupid question but im not too familiar with tcpdump... which interface should be the appropriate choice for watching inbound traffic? (And not capturing everything you do while browsing through the NANO interface) It should be the last one and should have the word "lan" in it, or at least that's the case for me. To easily find out, try every one until it tells you that it's scanning 255 addresses and NOT -1 addresses. Link to comment Share on other sites More sharing options...
Purrball Posted January 22, 2016 Share Posted January 22, 2016 It should be the last one and should have the word "lan" in it, or at least that's the case for me. To easily find out, try every one until it tells you that it's scanning 255 addresses and NOT -1 addresses. Cool, that's the one I tried but it was capturing everything I clicked on while going through settings in the Dashboard. I guess that's an unintended side effect of a shared connection? Thanks! Link to comment Share on other sites More sharing options...
Purrball Posted February 4, 2016 Share Posted February 4, 2016 Anybody else running tcpdump and encountering crashing? It doesn't last for more than a few hours at most, the process seems to die without any information, and when heading back into the module settings it's 'not running'. Trying to run it again ends up crashing the Pineapple and I'm forced to reboot or shut it down. Link to comment Share on other sites More sharing options...
sud0nick Posted February 5, 2016 Share Posted February 5, 2016 I'm noticing that it turns wlan1 into wlan1mon even when I select wlan2 for capture and doesn't change it back after tcpdump is stopped. This conflicts with PineAP and as far as I can tell requires a reboot of the NANO since I couldn't bring it back up using iw or ifconfig (maybe I was doing it wrong). The exact command run from the module was tcpdump -i wlan2 -v -X Can you fix this WM? Link to comment Share on other sites More sharing options...
Whistle Master Posted February 6, 2016 Author Share Posted February 6, 2016 Well, that's really weird because this is not done by the module. The module does not change the interfaces. The command as you see it in the GUI is directly started without any modification. I guess you're using a usb wireless adapter with your nano ? I tried with my second wireless adapter with the exact command you gave and I don't have any issue, the module does not change anything with the interfaces. You can see it yourself by starting your command from the module, then ssh to the NANO and issue "ps | grep tcpdump" you will see that it's using the correct interface. Link to comment Share on other sites More sharing options...
sud0nick Posted February 6, 2016 Share Posted February 6, 2016 I tested it out a couple more times with the NANO. Yes, I am using a USB wireless card for client mode on my home network. Here is exactly what's happening: Boot NANO, access it from (192.168.x.x IP), run ifconfig (everything is normal) Select tcpdump options as shown in previous post and start running it for capture on wlan2 Stop capture and check ifconfig (wlan1 is gone and wlan1mon is in its place). One thing I noticed yesterday is when I access the NANO via its 172.16.42.1 IP this issue doesn't come up. Could this be from accessing the NANO with the IP assigned to wlan2 then attempting to capture on wlan2? Link to comment Share on other sites More sharing options...
Purrball Posted February 7, 2016 Share Posted February 7, 2016 Adding to my previous post, today tcpdump is giving me Segmentation faults when crashing, suppose that's a better report, if I can be helpful with info at all... Link to comment Share on other sites More sharing options...
skib Posted March 21, 2016 Share Posted March 21, 2016 I have installed the tcpdump on the SD card (on my nano). It - sort of - works - sometimes - but seems unpredictable and unreliable. It does capture "things", but it seems impossible to interpret (as normal frames). The log sometimes does not seem to update. The history sometimes does not seem to update. Sometimes - when I stop a session - suddenly the log updates and indicates that a large number of frames were captured, but there is nothing in the history. Link to comment Share on other sites More sharing options...
Whistle Master Posted March 21, 2016 Author Share Posted March 21, 2016 The log in the module does not "show" a lot of things, only when you stop tcpdump, you'll see some stats, so that's normal behaviour It can happen that the history log is not refreshed. In that case it can be refreshed with the Refresh button. Then, you have to download the history file to analyse it with Wireshark for example. Link to comment Share on other sites More sharing options...
JCAG Posted December 18, 2016 Share Posted December 18, 2016 Hey Whistle, Just wanted to give you a shout-out! I finally got around to using the tcpdump module today, and oh man...when I tested it out with some wireless devices that were connected to the wifi pineapple (using an Internet Connection Sharing through a VPN, no less) and I browsed some websites that fail to use https even at a login page (*face-palm*) I was able to see the usernames and passwords in clear plain-text. If this doesn't scare lazy web-developers, I don't know what will... I'm going to use this method from now on as an example to show people why http has GOT TO GO. Thanks for a great tool! Link to comment Share on other sites More sharing options...
dummys Posted April 21, 2017 Share Posted April 21, 2017 Dear @Whistle Master Your module is not working on latest TETRA with latest firmware. It seems that the modules.php in api is broken. When starting tcpdump module I get a log saying "/pineapple/modules/tcpdump/scripts/tcpdump.sh: eval :line 1 : -w: not found". After debugging a little bit your stuff it appears that in modules.php the: $this->request->command doesn't yield any command. Thus the concatenation is working but without any command. Can you fix it please ? Thanks. Cheers, Jon Link to comment Share on other sites More sharing options...
_bugs_ Posted February 7, 2018 Share Posted February 7, 2018 Hi, I have just flashed my Nano on the latest firmware, formatted my SD card and reinstalled all my modules from scratch *on the SD card*. I just tried to run tcpdump, after installing the dependencies and I am getting the following error: /pineapple/modules/tcpdump/scripts/tcpdump.sh: eval: line 1: -w: not found Anyone can help troubleshooting this problem? Thanks. Bugs. Link to comment Share on other sites More sharing options...
_bugs_ Posted February 7, 2018 Share Posted February 7, 2018 By the way, it makes no difference if I install the plugin on Internal memory. Also, I can ssh to the NANO and run the tcpdump executable fine... just getting an error from the GUI. Thanks. Bugs. Link to comment Share on other sites More sharing options...
_bugs_ Posted February 8, 2018 Share Posted February 8, 2018 Hi Again, Ok, so I have troubleshooted the problem. I don't know how this module can work for anyone in its current state... looked at the /pineapple/modules/tcpdump/scripts/tcpdump.sh that line: eval ${MYCMD} is what is causing the problem and the variable is set by MYCMD=`cat /tmp/tcpdump.run` looking at what that tcpdump.run is, produces: -w /pineapple/modules/tcpdump/dump/dump_1518077505.pcap 2> /tmp/tcpdump_capture.log so the problem is that tcpdump is missing from the beginning of that line! I fixed the problem by changing the variable line to MYCMD="tcpdump `cat /tmp/tcpdump.run`" But then I get the following error on the GUI tcpdump: /pineapple/modules/tcpdump/dump/dump_1518077956.pcap: No such file or directory So I just created that dump folder and now it runs.... Again, this was from a fresh Nano firmware install, with an empty SD card. Doesn't seem like it is normal behavior ;) Hope it helps someone if they have the same problem. B. Link to comment Share on other sites More sharing options...
bxwifi Posted May 14, 2018 Share Posted May 14, 2018 I had the same problem and followed your instructions and it worked. After messing around with the settings, I chose an interface under the configurations which generated a command in the UI, and then I started getting the command "tcpdump tcpdump ..." So it looks like you need to choose some settings to generate a command in the UI to avoid the missing tcpdump command in the eval. Link to comment Share on other sites More sharing options...
micadunet Posted May 16, 2018 Share Posted May 16, 2018 Hi, I installed the module tcpdump on my sd card. When I click on start, nothing happens. How can I resolve that bug? I really don t understand. thanks a lot Link to comment Share on other sites More sharing options...
Just_a_User Posted May 25, 2018 Share Posted May 25, 2018 @Whistle Master On firmware 2.1.0 installation seemed to miss making the dump directory, once made dumps are working. The history section is empty even though dumps exists and the history counter is counting something else. Link to comment Share on other sites More sharing options...
b0N3z Posted May 26, 2018 Share Posted May 26, 2018 20 hours ago, Just_a_User said: @Whistle Master On firmware 2.1.0 installation seemed to miss making the dump directory, once made dumps are working. The history section is empty even though dumps exists and the history counter is counting something else. Responder history is doing the same thing. Link to comment Share on other sites More sharing options...
p28312 Posted August 22, 2018 Share Posted August 22, 2018 On firmware 2.3.1 - TCP Dump 1.5 /pineapple/modules/tcpdump/scripts/tcpdump.sh: eval: line 1: -w: not found Link to comment Share on other sites More sharing options...
Just_a_User Posted August 22, 2018 Share Posted August 22, 2018 3 hours ago, p28312 said: On firmware 2.3.1 - TCP Dump 1.5 /pineapple/modules/tcpdump/scripts/tcpdump.sh: eval: line 1: -w: not found dump directory is not made on install mkdir /pineapple/modules/tcpdump/dump Link to comment Share on other sites More sharing options...
p28312 Posted August 22, 2018 Share Posted August 22, 2018 5 hours ago, Just_a_User said: dump directory is not made on install mkdir /pineapple/modules/tcpdump/dump Thanks, I create the dump directory, i still get the same error. Any other suggestions? Link to comment Share on other sites More sharing options...
Just_a_User Posted August 22, 2018 Share Posted August 22, 2018 1 hour ago, p28312 said: Thanks, I create the dump directory, i still get the same error. Any other suggestions? Ummm your not trying to run that script on its own are you? to use tcpdump you can just run the tcpdump command from terminal. Once the dump dir is made the module should work as is, well, it does for me on both tetra and nano. Link to comment Share on other sites More sharing options...
p28312 Posted August 22, 2018 Share Posted August 22, 2018 1 minute ago, Just_a_User said: Ummm your not trying to run that script on its own are you? to use tcpdump you can just run the tcpdump command from terminal. Once the dump dir is made the module should work as is, well, it does for me on both tetra and nano. No, from the module (web GUI). I created the directory from terminal. I'll try to do it via the tcpdump command too. Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.