Develop Bugs

Wireless Sniffing

Part of my work in network administration is to locate and deal with "rogue" access points that might comprimise network security. Currently I'm using a Sharp Zaurus with Kismet to do this, but I don't always carry it with me and I DO always have my Cingular/AT&T 8525. I basically need a program that will capture all packets from the air into a file that can later be analyzed with Wireshark (Ethereal).
Yesterday I did a search of the Hermes threads looking for such a program and found several for MW5 and TyTn, (which I assume is another Hermes phone). None of them work, because they can't/don't put my WIFI interface into promiscuous mode.
From what I have read, it seems that the wireless drivers are the key here. I'm currently running ROM version vp3G 3.0.0 with Radio 1.41.00.10, which I downloaded from a link found here. Previously I had used several others of the excellent WM6 ROMs available on this forum, but never tried using the 8525 as a sniffer with any of them.
Question: Does anyone know of a ROM/software configuration for the 8525 that will allow promiscuous sniffing of WI-FI networks?
TIA
Walt

Damn, u want your phone to launch missles or something too?

yea and i want an tool to sniff the password of wpa-psk TKIP
thats where the best moment of my life.

Long as we are making requests, I need a packet sniffer that works for the gprs radio of my phone, not the wifi radio. Is there such a creature?
I am no pro at wifi sniffing, but this program had a promiscuous mode, I think.
http://www.airscanner.com/downloads/sniffer/sniffer.html

Long as we are making requests, I need a packet sniffer that works for the gprs radio of my phone, not the wifi radio. Is there such a creature?
I am no pro at wifi sniffing, but this program had a promiscuous mode, I think.
http://www.airscanner.com/downloads/...r/sniffer.html
Yesterday 12:23 PM
Click to expand...
Click to collapse
Now that WOULD be cool! Maybe illegal? Would sniffing data from a cellular connection be the same thing as a cellular wiretap?
I did try AirScanner, and it's a great sniffer, but it won't put the wireless I/F into promiscuous mode, so I can only look at packets addressed to my device.
What I'm really trying to learn here, missles notwithstanding ;D is whether or not this is a hardware limitation. If not, then I will continue to look for software and/or ROM drivers that will work.
Walt

try aircrack

larsuck said:
Long as we are making requests, I need a packet sniffer that works for the gprs radio of my phone, not the wifi radio. Is there such a creature?
Click to expand...
Click to collapse
Not sure what you'd achieve, as encryption is negotiated between each SIM and its authorising server. Intermediate equipment only gets to see the encrypted stream. Even if your chipset was capable of full-time reception, your battery would go down a lot quicker, and all you'd see is how many channels and timeslots are in use, if that!

I need to sniff the ip info of my data connection. I have tried almost every other means of getting it and am at my wits end. I figured it was probably encoded, but at this point I am grasping at straws.

I have used VXsniffer before (http://www.cambridgevx.com) on one of my Ipaq PDAs and it worked great but that was about 2 years ago. I have not been able to find any intrusive "sniffing" programs that have worked on my Tytn but there are tools out there that work with the current ROMs (VP3G's and Schaps) that are like Ministumbler and will show you AP locations. (Wififofum and SniffThis come to mind) They have their bugs but in general they work.
I searched for days when I first got my Tytn for an intrusive sniffer and never found anything.
Brad

I've used WiFiFoFum and Mini Stumbler (off-shoot of network stumbler). I can't say from memory if they do promiscuous or just passive scanning, but both produce results that can be analyzed in NetStumbler or Ethereal.
-Steve
walts said:
Part of my work in network administration is to locate and deal with "rogue" access points that might comprimise network security. Currently I'm using a Sharp Zaurus with Kismet to do this, but I don't always carry it with me and I DO always have my Cingular/AT&T 8525. I basically need a program that will capture all packets from the air into a file that can later be analyzed with Wireshark (Ethereal).
Yesterday I did a search of the Hermes threads looking for such a program and found several for MW5 and TyTn, (which I assume is another Hermes phone). None of them work, because they can't/don't put my WIFI interface into promiscuous mode.
From what I have read, it seems that the wireless drivers are the key here. I'm currently running ROM version vp3G 3.0.0 with Radio 1.41.00.10, which I downloaded from a link found here. Previously I had used several others of the excellent WM6 ROMs available on this forum, but never tried using the 8525 as a sniffer with any of them.
Question: Does anyone know of a ROM/software configuration for the 8525 that will allow promiscuous sniffing of WI-FI networks?
TIA
Walt
Click to expand...
Click to collapse

I have never heard of promisc mode being possible on any WM device. I believe i've read that it is in fact a hardware limitation. but who knows, with all the hacked drivers that float around maybe someone will get around this.
now that i mention it... it could be sufficient to disassemble the wireless drivers / ip stack (they are NOT on the radio rom) and NOP out the function that checks the mac address. or change the branch instruction at the end of it to "always execute" as if it were matching the device's own mac address. hmm. it wouldn't be true promisc mode, but it could work.
think i might give it a go myself.
in the mean time, if youre concerned about rogue APs on your network, check out my recent post about my discovery of how to enable Internet Sharing over WiFi (turns the phone into an Access Point):
http://forum.xda-developers.com/showthread.php?t=332360
not directly related, but might be of interest.
fluxist

larsuck said:
I need to sniff the ip info of my data connection. I have tried almost every other means of getting it and am at my wits end. I figured it was probably encoded, but at this point I am grasping at straws.
Click to expand...
Click to collapse
Tried vxIPConfig from Cambridge (http://www.cambridgevx.com) ?

gregnash said:
Tried vxIPConfig from Cambridge (http://www.cambridgevx.comhttp://www.cam.com) ?
Click to expand...
Click to collapse
Looks like it could be a winner. Since I do not know enough of the teck behind it all, if someone tries this out and it works out, report back your findings for the rest of us
GB

walts said:
Question: Does anyone know of a ROM/software configuration for the 8525 that will allow promiscuous sniffing of WI-FI networks?
Click to expand...
Click to collapse
For trinity and hermes, I've found nothing. Drivers... you know
But Airscanner is the best, I'm using it on an Ipaq...
Ciao

larsuck said:
I need to sniff the ip info of my data connection. I have tried almost every other means of getting it and am at my wits end. I figured it was probably encoded, but at this point I am grasping at straws.
Click to expand...
Click to collapse
try to tether and run www.speedtest.net unless your network is on a proxy
from your computer it will be easy to dermine the IP. www.speedtest.com is easy because it tels your speed + ip and carrier connection

gemblaster said:
Looks like it could be a winner. Since I do not know enough of the teck behind it all, if someone tries this out and it works out, report back your findings for the rest of us
GB
Click to expand...
Click to collapse
vxIPConfig is not a packet sniffing tool like Wireshark (Ethereal) or the like. It gives you "ipconfig /release" and "ipconfig /renew" functions and can give you TCP, UDP and IP stats but can’t actually capture the packets and view the encapsulation headers.
AirScanner and vxSniffer are the only 2 moderately priced utilities that can do that for WindowsMobile that I am aware of.

Park City said:
vxIPConfig is not a packet sniffing tool like Wireshark (Ethereal) or the like. It gives you "ipconfig /release" and "ipconfig /renew" functions and can give you TCP, UDP and IP stats but can’t actually capture the packets and view the encapsulation headers.
AirScanner and vxSniffer are the only 2 moderately priced utilities that can do that for WindowsMobile that I am aware of.
Click to expand...
Click to collapse
Just checked those two out and our Hermes WiFi adapter doesn't support promiscuous mode

Memnoch30 said:
Just checked those two out and our Hermes WiFi adapter doesn't support promiscuous mode
Click to expand...
Click to collapse
Is there anyone that understands the inner workings of our WiFi adaptors and drivers that may be able to shed some light if there would be a hack that would make our Hermes compatable with these programs? If so then maybe the search could be over . So far this looks like the closest it's come.

Sniffing
I also am in the field of network security.
I use Wififofum for searching and logging all wireless networks. It has filters such as show only non secure etc. It also has GPS log support. You can then convert the log files to upload as a overlay on google earth.
Airscanner works great on the trinity as a packet sniffer of the wireless.
Just my 2cents

It doesn't matter how many programs you try it won't work. Promiscuous mode is being prevented by the driver. The only possible work around would be if someone made a new driver using an open source driver. Since HTC has not released any open source drivers for their device I see no possible solution.

ICMP Tunneling on Rhodium (Windows Mobile)?

Rhodium Friends,
I am trying to think of a method for tunneling ICMP to our lovely Rhodium device? An ICMP tunnel establishes a covert connection between two remote computers (a client and proxy), using ICMP echo requests and reply packets. This is great for mobile ISPs which permit ping to your phone, but disallow all incoming ports to your phone.
I'm sure the Linux-based phones (Android, Nokia N900) would allow this by using a Linux program called Loki or Ptunnel, but what are we Windows Mobile users to do?
The idea is to have an application that allows you to reliably tunnel TCP connections to a remote host using ICMP echo request and reply packets, commonly known as ping requests and replies.
Use Case Scenario: You're on the go, and stumble across an open wireless network. The network gives you an IP address, but won't let you send TCP or UDP packets out to the rest of the internet, for instance to check your mail. What to do? By chance, you discover that the network will allow you to ping any computer on the rest of the internet. With ICMP tunneling, you can utilize this feature to check your mail, or do other things that require TCP.
Does anyone have any ideas?
Thanks!

mail_e36 said:
Rhodium Friends,
I am trying to think of a method for tunneling ICMP to our lovely Rhodium device? An ICMP tunnel establishes a covert connection between two remote computers (a client and proxy), using ICMP echo requests and reply packets. This is great for mobile ISPs which permit ping to your phone, but disallow all incoming ports to your phone.
I'm sure the Linux-based phones (Android, Nokia N900) would allow this by using a Linux program called Loki or Ptunnel, but what are we Windows Mobile users to do?
The idea is to have an application that allows you to reliably tunnel TCP connections to a remote host using ICMP echo request and reply packets, commonly known as ping requests and replies.
Use Case Scenario: You're on the go, and stumble across an open wireless network. The network gives you an IP address, but won't let you send TCP or UDP packets out to the rest of the internet, for instance to check your mail. What to do? By chance, you discover that the network will allow you to ping any computer on the rest of the internet. With ICMP tunneling, you can utilize this feature to check your mail, or do other things that require TCP.
Does anyone have any ideas?
Thanks!
Click to expand...
Click to collapse
MOST cellphone users are NAT'ed so it wouldn't matter, period. You can't directly connect from the outside to the phone no matter what.

Tmobile in the US does give you a 'static' non-NAT'd address... if you request it. This type of IP address would permit ICMP tunneling, if we can figure out a way to do it.

[Q] VPN on Rhod 100 TP2

I have the latest Froyo6 build on my Froyo TP2 Rhod_100 UK
I have been trying to set up the VPN, but I can not get it working. Does anyone know why and how I can sort this out please?
PS. I also tried to run a VoIP (SIP) client (3CX) on the machine, but that too does not work.
My airtime provider is Vodafone UK and they have assured me that both are enabled on my account at a princely sum of £15 per month! Needless to say at that cost I am dead keen to make this work.

jonners59 said:
I have the latest Froyo6 build on my Froyo TP2 Rhod_100 UK
I have been trying to set up the VPN, but I can not get it working. Does anyone know why and how I can sort this out please?
PS. I also tried to run a VoIP (SIP) client (3CX) on the machine, but that too does not work.
My airtime provider is Vodafone UK and they have assured me that both are enabled on my account at a princely sum of £15 per month! Needless to say at that cost I am dead keen to make this work.
Click to expand...
Click to collapse
Can you get either to work on wifi?

I know there were some Chinese users trying to get the VPN to work, and couldn't.
I haven't tried, as I have no use for a VPN on my phone lol.
Also, I have known people to get SIP working, but it wasn't so great from what I heard...

Sorry I was not getting alerts and the thread was not showing up in my subs....
If I use WiFi then I am at home and do not need the VPN, but the SIP Phone DOES work and very well.
If I use the WM as a gateway for my laptop, then the laptop can run a VPN and SIP Phone via the phone. If that makes sense to you. Thus the Router running the VPN is working and the config works, and the mobile operator has set up the service. So this is just the phone settings - I believe.

jonners59 said:
Sorry I was not getting alerts and the thread was not showing up in my subs....
If I use WiFi then I am at home and do not need the VPN, but the SIP Phone DOES work and very well.
If I use the WM as a gateway for my laptop, then the laptop can run a VPN and SIP Phone via the phone. If that makes sense to you. Thus the Router running the VPN is working and the config works, and the mobile operator has set up the service. So this is just the phone settings - I believe.
Click to expand...
Click to collapse
If I had a VPN I could connect to I would test it out...
Maybe its a misconfiguration in Android? broken driver or config?

I do not know. It tells me nothing. The settings are as per the router config. How do I find out what is incorrect/broken etc...?

Can you give as many details as possible on the type of VPN I'm trying to connect to?
It's probably not working because none of the devs use that function - and can't debug it without trying to reproduce your setup.
I might play with it a little as it would potentially let me remotely schedule MythTV recordings safely, but it would be pretty low-pri for me.

I am using at this stage a simple PPTP setup for now. The Android settings are minimal - username and PW, and that is it.
But my laptop, which works has more settings o configure. I.e. MSCHAP and MSCHAPv2
Point to point MPPE
Security 128b and/or 40b
Allow BSD
Allow Deflate data comp
Allow TCP header comp
Does this help

OK, sometime in the next week or two I'll try to get PPTP up and running using similar parameters. I've been meaning to do it in general (not phone-related) for other reasons anyway - but it's been a low priority for a long time.

Entropy512 said:
OK, sometime in the next week or two I'll try to get PPTP up and running using similar parameters. I've been meaning to do it in general (not phone-related) for other reasons anyway - but it's been a low priority for a long time.
Click to expand...
Click to collapse
Why not OpenVPN? Seems like it would be easier/more standards-compliant that a craptacular PPTP VPN .

arrrghhh said:
Why not OpenVPN? Seems like it would be easier/more standards-compliant that a craptacular PPTP VPN .
Click to expand...
Click to collapse
I'll look into what VPN options Android supports - although for the OP, he may have specific reasons forcing PPTP.

arrrghhh said:
Why not OpenVPN? Seems like it would be easier/more standards-compliant that a craptacular PPTP VPN .
Click to expand...
Click to collapse
Because I am working with Draytek, my router. Vendor to set up the VPN and this was the. First config as it was the simplest. Seems everything else works, just. Not the. Phone. The phone too has PPTP as a standard setting.

Eh, I prefer to avoid PPTP like the plague if I have any choice. Most companies don't provide a choice, so I figured that's why you were locked in.
If you do have a choice, I would try something different. That's just me tho, I'd prefer open to closed any day if I had the choice .

Just a side note - the built-in Android VPN support uses pppd. The ril currently uses "killall pppd" to disable mobile data. If you're using both at once, then this will kill the VPN too. This is a stupid flaw in the current ril code, which is fixed in the "initpppd" branch of my ril repo. (But the initpppd branch depends on a number of rootfs fixes before it is usable, and stinebd has not merged any of it yet.)

highlandsun said:
Just a side note - the built-in Android VPN support uses pppd. The ril currently uses "killall pppd" to disable mobile data. If you're using both at once, then this will kill the VPN too. This is a stupid flaw in the current ril code, which is fixed in the "initpppd" branch of my ril repo. (But the initpppd branch depends on a number of rootfs fixes before it is usable, and stinebd has not merged any of it yet.)
Click to expand...
Click to collapse
Thanks for the reminder of that, I remember the discussions on the dev list.
I'm going to shelve poking at the VPN stuff until the RIL overhaul stabilizes and gets mainlined in this case.

Entropy512 said:
I'll look into what VPN options Android supports - although for the OP, he may have specific reasons forcing PPTP.
Click to expand...
Click to collapse
OK, please excuse slowness of response. As arrghh knows from another thread I am in transit across Europe. I reached my destination, Italy and have spent the past few days getting internet access *broadband virtually does not exist here unless you are in a City, so I have to use a very slow mobile broadband).
I am not a techie, but I am a willing player with some knowledge - dangerous, I know. I have been assisted by the manufacturer of my Router, a Draytek 2820 to set up a VPN. We may make it a more sophisticated VPN later, but pptp is the easiest. I have it working on all laptops and PCs, including this old banger here in Italy. What I can NOT do, is get it working on the phone. I think it is communicating with the router, but it is not getting through.
PS the PCs and Laptops are all Linux - Ubuntu 10.10
Hope this helps

I'm one of those Chinese who tried using VPNs on my Raphael, but failed of course. Actually, neither on WM, nor on Android, neither via pptp, nor via l2tp over ipsec. What I wanna remind is VPN on most Android roms on hd2 works fine, but some roms also cannot support vpn.
If you have enough time, I don't know how to pray for, would you please explore l2tp over ipsec? Because in many cities in China, pptp is also blocked by ISP. And I can provide a test account if anyone needs it.
Btw, I believe vpn is necessary when connecting a public wifi
Sent from my MSM using XDA Premium App

One more report, vpn in pptp could not work..

At this point - I'm going to hold off on poking at this until highlandsun's new RIL settles out and is officially committed. Some of the dev traffic correspondence indicates that the way we currently handle PPP is incompatible with VPNs. His new ril + rootfs combo that changes the pppd control architecture MIGHT solve some of the PPTP issues, I haven't tried them yet.

See it.
May your works come out soon~

[Q] Hide Hotspot Traffic via VPN

I want to prevent my carrier from knowing that I am using CM11's native Hotspot or Tethering features. I know that they can look at the TTL of packets or analyze the traffic (Windows Update, Steam) to detect this. I have a subscription to a VPN service, Private Internet Access, which has an app on Android. If I enable the VPN mode of this app, will all the Hotspot traffic be routed through it, completely invisible to the carrier?
Searching showed me some conflicting answers on this, with some people saying to run it on the tethered device, and others saying to run it on the phone. I am thinking running VPN on phone, as the packets should appear to originate from the phone, rather than something 1 hop behind it.

kcattakcaz said:
I want to prevent my carrier from knowing that I am using CM11's native Hotspot or Tethering features. I know that they can look at the TTL of packets or analyze the traffic (Windows Update, Steam) to detect this. I have a subscription to a VPN service, Private Internet Access, which has an app on Android. If I enable the VPN mode of this app, will all the Hotspot traffic be routed through it, completely invisible to the carrier?
Searching showed me some conflicting answers on this, with some people saying to run it on the tethered device, and others saying to run it on the phone. I am thinking running VPN on phone, as the packets should appear to originate from the phone, rather than something 1 hop behind it.
Click to expand...
Click to collapse
To the best of my knowledge, they could easily know that you are connecting to the VPN tunnel as it utilizes a certain ports. However if it's correctly set up and utilize a secure protocol, all your traffic will get through the VPN and your ISP won't be able to decipher your online activities and your connection type or make sense of your internet traffic.
In other words, you may be using the VPN to connect to websites A, B, and C and send all sorts of interesting information to those websites; or send email; or whatever. Your ISP can see none of that. All they can see is encrypted data that they can't decrypt. So they know you're using a VPN, but they don't know what you're using it for.
Hope it could help.

Fascist networks do not allow me to tether

As per title, some extremely vile phone companies do not allow us to tether, even though it is our allowance which we have paid for after all.
But how do they know that we are tethering? I presume there must be some software way to hide the fact that some internet data is diverted to another device? How do firewalls do it? You may have 100 PCs and laptops and phones in your house but everyone outside your house sees all your devices as a single IP address - it is your firewall that receives the incoming packets from the internet and distributes them internally. Now I know that it does this by "hiding" the internal IP addresses somewhere in the headers, maybe, so that would be a tell.
If anyone knows a proper way please let me know.
Many thanks