SOLVED ofxSniffer and packet sniffing

beginners
#1

Hi, I am trying to get @halfdanj 's ofxSniffer working on OSX. I want to use it to detect arp requests- I think it is the right library for the job.

I managed to get everything compiling but with a few difficulties. I had to change this line

newRawPacketEvent.notifyAsync(this, packet);

to

newRawPacketEvent.notify(this, packet);

I am using 64 bit libs from ofxLibTins as I could not get the apothecary script to run. I managed to get the libs linking properly but only by making a new project. I gave the library the correct permissions and my wifi goes into monitor mode as expected.

However as soon as I get a packet the program crashes- I have attached a screen shot of xcode of the crash.

Screen Shot 2015-12-22 at 10.02.51.png3840×2400 753 KB

I found this issue - https://github.com/openframeworks/openFrameworks/issues/4192 where the notifyAsync has been replaced by using ofThreadChannel, but the ofxSniffer code has both methods in place still. Does anyone have a functioning version of ofxSniffer? Or maybe a clue as to how to get this (or at least libtins) running?

Cheers

Fred

#2

OK, I think I may have found the error, when I stop trying to read the SSID the program runs fine- it was nothing to do with the events or threads. I am not at my own place so I cannot mess with the router but my guess is that the SSID has a dash “-” in the name and this is causing the problem. I’ll try again with my own hardware later to see if that was really the problem, otherwise it seems to be working fine.

#3

So, I got a little bit further, I am trying to detect ARP requests, here is my code, I based it on the other methods in the sniffer addon:

class ofxSnifferARPRequestFrame {
public:
    bool isValid = false;

    string ssid;
    HWAddress<6> addr;

    ofxSnifferARPRequestFrame() {}

    ofxSnifferARPRequestFrame(Packet packet) {
        try {
            packet.pdu()->rfind_pdu<Tins::ARP>();
            cout<<"ARP REQUEST RECEIVED"<<endl;

            const Tins::ARP &data = packet.pdu()->rfind_pdu<Tins::ARP>();

            addr = get_dst_addr_ARP(data);
            isValid = true;
        } catch (...) {
        }
    }
};

The code compiles, but I dont get any response when an arp request is present on the network. I checked with wirecast and I do see an arp request when I connect a new device to the network. As far as I could tell this line:

 packet.pdu()->rfind_pdu<Tins::ARP>();
 <<"ARP REQUEST RECEIVED"<<endl;

Should print out “ARP REQUEST RECEIVED” if the packet is formatted as an ARP request. As usual I am a little over my head.

For reference the addon I am using is here:

Cheers

#4

Ok, of course I was not paying enough attention, the first error was due to the fact that I could not insert the SSID it needed to be converted to a string (this does not make so much sense to me as the type was a string but it did solve the problem.

The arp request was also a simple solve, to get arp requests the sniffer should not put the wifi into monitor mode, as it was set in the examples.

Just in case someone else tries to do the same.

Fred