nzyme can't turn on monitor mode due to libpcap not being linked against libnl #339

steev · 2021-03-22T22:05:55Z

steev
Mar 22, 2021

So, I have a custom kali installation on an RPi 4 - custom in that, it uses the kali kernel and not the kernel from either re4son or the rpi foundation.

┌──(root💀nzyme)-[~]
└─# uname -a
Linux nzyme 5.10.0-kali4-arm64 #1 SMP Debian 5.10.19-1kali1 (2021-03-03) aarch64 GNU/Linux

I'm connecting it to the network with the ethernet port, and have both wlan0 free, as well as an mt76x2, however, similar to #336 I get the output of

22:02:27.861 [probe-loop-0] ERROR horse.wtf.nzyme.dot11.probes.Dot11Probe - Could not initialize probe [broad-monitor-wlp1s0u1u3]. Retrying soon.
horse.wtf.nzyme.dot11.probes.Dot11ProbeInitializationException: Could not build PCAP handle.
        at horse.wtf.nzyme.dot11.probes.Dot11MonitorProbe.initialize(Dot11MonitorProbe.java:149) ~[nzyme-1.0.0.jar:?]
        at horse.wtf.nzyme.dot11.probes.Dot11MonitorProbe.lambda$loop$0(Dot11MonitorProbe.java:163) ~[nzyme-1.0.0.jar:?]
        at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515) [?:?]
        at java.util.concurrent.FutureTask.run(FutureTask.java:264) [?:?]
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128) [?:?]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628) [?:?]
        at java.lang.Thread.run(Thread.java:829) [?:?]
Caused by: org.pcap4j.core.PcapNativeException: That device doesn't support monitor mode
        at org.pcap4j.core.PcapHandle.<init>(PcapHandle.java:166) ~[nzyme-1.0.0.jar:?]
        at org.pcap4j.core.PcapHandle.<init>(PcapHandle.java:45) ~[nzyme-1.0.0.jar:?]
        at org.pcap4j.core.PcapHandle$Builder.build(PcapHandle.java:1529) ~[nzyme-1.0.0.jar:?]
        at horse.wtf.nzyme.dot11.probes.Dot11MonitorProbe.initialize(Dot11MonitorProbe.java:143) ~[nzyme-1.0.0.jar:?]
        ... 6 more

However...

┌──(root💀nzyme)-[~]
└─# iw wlp1s0u1u3 info
Interface wlp1s0u1u3
        ifindex 4
        wdev 0x100000001
        addr 00:c0:ca:95:89:39
        type monitor
        wiphy 1
        channel 1 (2412 MHz), width: 20 MHz (no HT), center1: 2412 MHz
        txpower 20.00 dBm
        multicast TXQ:
                qsz-byt qsz-pkt flows   drops   marks   overlmt hashcol tx-bytes        tx-packets
                0       0       0       0       0       0       0       0               0

It doesn't matter whether I try to start nzyme with the device in monitor, managed or auto, I always end up with the error that the device doesn't support monitor mode. However, I most certainly can, and do use them in monitor mode.

I've also installed python3-scapy, aircrack-ng, sudo and wireless-tools

lennartkoopmann · 2021-03-22T22:07:29Z

lennartkoopmann
Mar 22, 2021
Maintainer

Hmmm, that's interesting. I wonder if something else is interfering with it. Can you post the output of ifconfig and iwconfig?

0 replies

steev · 2021-03-22T22:08:09Z

steev
Mar 22, 2021
Author

┌──(root💀nzyme)-[~]
└─# ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.xx.xx  netmask 255.255.255.0  broadcast 192.168.xx.xx
        inet6 fe80::dea6:32ff:fe07:8d36  prefixlen 64  scopeid 0x20<link>
        ether dc:a6:32:07:8d:36  txqueuelen 1000  (Ethernet)
        RX packets 90979  bytes 48588055 (46.3 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 14970  bytes 3593141 (3.4 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 29381  bytes 9750637 (9.2 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 29381  bytes 9750637 (9.2 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wlan0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        ether dc:a6:32:07:8d:37  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wlp1s0u1u3: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        unspec 00-C0-CA-95-89-39-00-00-00-00-00-00-00-00-00-00  txqueuelen 1000  (UNSPEC)
        RX packets 96671  bytes 10749452 (10.2 MiB)
        RX errors 0  dropped 96671  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0


┌──(root💀nzyme)-[~]
└─# iwconfig
lo        no wireless extensions.

eth0      no wireless extensions.

wlan0     IEEE 802.11  ESSID:off/any
          Mode:Managed  Access Point: Not-Associated   Tx-Power=31 dBm
          Retry short limit:7   RTS thr:off   Fragment thr:off
          Encryption key:off
          Power Management:on

wlp1s0u1u3  IEEE 802.11  Mode:Monitor  Frequency:2.412 GHz  Tx-Power=20 dBm
          Retry short limit:7   RTS thr:off   Fragment thr:off
          Power Management:off

1 reply

lennartkoopmann Mar 22, 2021
Maintainer

Thanks! Is there something like NetworkManager running? You said that you installed aircrack-ng - Can you run airmon-ng check kill?

steev · 2021-03-22T22:13:24Z

steev
Mar 22, 2021
Author

NetworkManager is not installed - this is a very minimal installation built from https://gitlab.com/steev/image-specs.git which only includes ssh parted dosfstools iw wpasupplicant kali-defaults zsh firmware-brcm80211 and a couple others (obviously the previously mentioned ones and the nzyme dependencies.)

┌──(root💀nzyme)-[~]
└─# airmon-ng check kill

Killing these processes:

    PID Name
    447 dhclient

I did attempt to use netplan to bring the interfaces up at boot time, but that wasn't much help.

10 replies

lennartkoopmann Mar 22, 2021
Maintainer

OK, this might be the problem then. I assume that libpcap (which nzyme is using) is checking for some device flags that the driver reports before putting something in monitor mode. Kismet is probably just trying to set it without checking first and I assume some drivers are falsely reporting their monitor mode capabilities or something else gets mixed up.

My experience with ALFA cards has been pretty good in the past but I have no experience with the atheros chips I believe.

If you say that it works with Kismet, I suggest I implement the following:

Allow user to skip setting card into monitor mode from within nzyme
Allow user to specify a command to put card into monitor mode (similar to the channel hop command). You could call iwconfig directly and nzyme just assumes that you put it into monitor mode yourself.

I'll transfer that into a ticket later and might produce a new release fairly quickly. (within a few days)

Would you be willing to test a pre-release?

steev Mar 22, 2021
Author

Just for giggles - I put it into monitor mode with airmon-ng start wlp1s0u1u3 - then changed the device in the nzyme config to wlp1s0u1u3mon

22:29:21.538 [probe-loop-0] INFO  horse.wtf.nzyme.dot11.probes.Dot11Probe - Building PCAP handle on interface [wlp1s0u1u3mon]
22:29:21.553 [probe-loop-0] ERROR horse.wtf.nzyme.dot11.probes.Dot11Probe - Could not initialize probe [broad-monitor-wlp1s0u1u3mon]. Retrying soon.
horse.wtf.nzyme.dot11.probes.Dot11ProbeInitializationException: Could not build PCAP handle.
        at horse.wtf.nzyme.dot11.probes.Dot11MonitorProbe.initialize(Dot11MonitorProbe.java:149) ~[nzyme-1.0.0.jar:?]
        at horse.wtf.nzyme.dot11.probes.Dot11MonitorProbe.lambda$loop$0(Dot11MonitorProbe.java:163) ~[nzyme-1.0.0.jar:?]
        at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515) [?:?]
        at java.util.concurrent.FutureTask.run(FutureTask.java:264) [?:?]
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128) [?:?]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628) [?:?]
        at java.lang.Thread.run(Thread.java:829) [?:?]
Caused by: org.pcap4j.core.PcapNativeException: That device doesn't support monitor mode
        at org.pcap4j.core.PcapHandle.<init>(PcapHandle.java:166) ~[nzyme-1.0.0.jar:?]
        at org.pcap4j.core.PcapHandle.<init>(PcapHandle.java:45) ~[nzyme-1.0.0.jar:?]
        at org.pcap4j.core.PcapHandle$Builder.build(PcapHandle.java:1529) ~[nzyme-1.0.0.jar:?]
        at horse.wtf.nzyme.dot11.probes.Dot11MonitorProbe.initialize(Dot11MonitorProbe.java:143) ~[nzyme-1.0.0.jar:?]
        ... 6 more

However, running airodump-ng -i wlp1s0u1u3mon`....

[CH 12 ][ Elapsed: 6 s ][ 2021-03-22 22:31

 BSSID              PWR  Beacons    #Data, #/s  CH   MB   ENC CIPHER  AUTH ESSID

 42:2B:50:AD:9B:12  -74        2        0    0   6  195   WPA2 CCMP   PSK  <length: 18>
 40:2B:50:AD:9B:10  -77        2        0    0   6  195   WPA2 CCMP   PSK  ATTaJNfMkI
 E8:D2:FF:BC:BD:06  -77        3        0    0   6  195   WPA2 CCMP   PSK  RapeDen2
 76:8A:0D:60:E4:72  -77        2        0    0  11  195   WPA2 CCMP   PSK  <length: 18>
 74:8A:0D:60:E4:70  -80        2        1    0  11  195   WPA2 CCMP   PSK  ATThemRHMS
 74:8A:0D:4A:64:30  -75        2        4    1   6  195   WPA2 CCMP   PSK  miller_west
 DC:EF:09:81:CE:EB  -73        3        0    0   6  195   WPA2 CCMP   PSK  Gully Guest
 84:A1:D1:79:90:40  -57        4        0    0   6  195   WPA2 CCMP   PSK  MySpectrumWiFi3a-2G
 EE:A9:40:C0:8C:72  -74        2        0    0  11  195   WPA2 CCMP   PSK  <length: 18>
 EE:A9:40:C0:8C:71  -74        3        0    0  11  195   WPA2 CCMP   PSK  Lauren Coronado
 94:91:7F:FD:5F:BE  -75        3        0    0  11  720   WPA2 CCMP   PSK  LAN31634-2
 14:B7:F8:D7:24:76  -57        5        2    0  11  195   WPA2 CCMP   PSK  full-on-Monet
 9C:AD:97:C0:06:FE  -40        9        0    0  11  195   WPA2 CCMP   PSK  DDW365EB
 88:96:4E:87:D7:D0  -66        2        0    0   1  195   WPA2 CCMP   PSK  ATTnrfWzvS
 8A:96:4E:87:D7:D2  -67        4        0    0   1  195   WPA2 CCMP   PSK  <length: 18>
 FE:AE:34:2F:35:C2  -67        2        0    0   1  195   WPA2 CCMP   PSK  <length: 18>
 78:29:ED:4C:BA:CD  -66        6        1    0  11  720   WPA2 CCMP   PSK  MySpectrumWiFiCF-2G
 12:93:97:83:65:E2  -71        2        0    0   1  195   WPA2 CCMP   PSK  <length: 18>
 94:83:C4:00:5E:F1  -34        7        0    0  11  130   WPA2 CCMP   PSK  GL-AR750S-ef1
 10:0C:6B:52:00:DF  -75        0       18    0   1   -1   WPA              <length:  0>
 B0:95:75:ED:E4:67  -77        2        0    0  10  195   WPA2 CCMP   PSK  <length:  0>
 F8:18:97:98:7D:19  -78        2        0    0   8  130   WPA2 CCMP   PSK  ATT8QJj3rY
 4E:12:65:AB:28:C2  -78        2        0    0   1  195   WPA2 CCMP   PSK  <length: 18>

 BSSID              STATION            PWR   Rate    Lost    Frames  Notes  Probes

steev Mar 22, 2021
Author

Of course, I'm willing to try anything at least once ;)

lennartkoopmann Mar 22, 2021
Maintainer

Awesome, thanks! Can you ping me at lennart@0x58ed.com real quick? I'll be in touch.

lennartkoopmann Apr 22, 2021
Maintainer

Manual monitor mode configuration is done in #347 and will be included in v1.1.0. Thanks again!

steev · 2021-03-22T23:03:16Z

steev
Mar 22, 2021
Author

Ah, looking into this - perhaps we're hitting https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=651783 but likely not, it should still do the "right thing" even if not linked against libnl

2 replies

steev Mar 23, 2021
Author

That was a dead end, and unfortunately, the 5.10 kernel (upstream - not raspberry pi foundation based) doesn't have working USB on 32bit. So that's a bummer. I'll tool around and create a minimal image with the re4son kernel and see what I can come up with there and see if the problem exists as well.

steev Mar 24, 2021
Author

Okay, fixed up the 32bit kernel config, and see the same issue on armhf, so that, is less than ideal.

steev · 2021-03-24T04:09:27Z

steev
Mar 24, 2021
Author

I think I've figured this out - if libpcap is not built against libnl, then libpcap will not automatically put the device into monitor mode. If however, it is, it will.

┌──(root💀kali-20210322)-[~/libpcap/source]
└─# tcpdump -I -i wlan1                                                                                             3 ⨯
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on wlan1, link-type IEEE802_11_RADIO (802.11 plus radiotap header), snapshot length 262144 bytes
04:05:51.371756 1.0 Mb/s 2412 MHz 11b -68dBm signal -68dBm signal antenna 0 -71dBm signal antenna 1 Beacon (PerezHome) [1.0* 2.0* 5.5* 11.0* 18.0 24.0 36.0 54.0 Mbit] ESS CH: 1, PRIVACY
04:05:51.375909 1.0 Mb/s 2412 MHz 11b -67dBm signal -67dBm signal antenna 0 -68dBm signal antenna 1 Beacon () [1.0* 2.0* 5.5* 11.0* 18.0 24.0 36.0 54.0 Mbit] ESS CH: 1, PRIVACY

04:09:01.243 [probe-loop-0] INFO  horse.wtf.nzyme.dot11.probes.Dot11Probe - Building PCAP handle on interface [wlan1]
04:09:01.813 [probe-loop-0] INFO  horse.wtf.nzyme.dot11.probes.Dot11Probe - PCAP handle for [broad-monitor-wlan1] acquired. Cycling through channels <1,2,3,4,5,6,7,8,9,10,11>.

So turns out my comment earlier about the debian bug IS what we are running into on Kali/Debian systems. I'll see what we can do here to get that fixed.

0 replies

steev · 2021-03-24T05:01:40Z

steev
Mar 24, 2021
Author

For anyone who needs to do this because they're trying to set it up, you will need to add a deb-src line to your /etc/apt/sources.list.

For Debian buster this would look like:

deb-src http://deb.debian.org/debian buster main contrib non-free

For Debian bullseye (aka testing):

deb-src http://deb.debian.org/debian bullseye main contrib non-free

For Debian sid (aka unstable):

deb-src http://deb.debian.org/debian sid main contrib non-free

For Kali this would look like:

deb-src http://http.kali.org/kali kali-rolling main contrib non-free

Then, run sudo apt update

Once that is done, we want to pull in some things to make sure we can build packages.

sudo apt install dpkg-dev build-essential -y

Now we'll create a directory to download the sources and build the package in...

mkdir -p source/libpcap/source - we do it this way because when you build packages, they're put into the directory UNDER your current one.

cd source/libpcap/source
apt source libpcap0.8
cd libpcap-1.10.0

Now we want to edit the debian/control file, and add a dependency to the Build-Depends line as well as the Depends of the libpcap0.8-dev Package. Simply add libnl-genl-3-dev, to the list - I put it under the libdbus-1-dev, line (and the comma is very important so do not leave it out!) You can use your preferred editor, I just prefer vim.

vim debian/control

Now in the libpcap-1.10.0 directory we run an apt command to pull in the build dependencies:

sudo apt build-dep . - again, the period is important - it's telling apt to install the dependencies that it finds in the debian/control file of the current directory; we want this and NOT libpcap0.8-dev because it does not have the added dependency.

Once the dependencies are installed, simply run

dpkg-buildpackage -uc -us -b

Once that is done, you should be able to cd .. and you will have all of the libpcap deb files in that directory. We then install the libpcap deb that we need sudo dpkg -i libpcap0.8_1.10.0-2_$arch.deb NOTE: you can use tab completion after the _ to complete the name if you do not know your architecture.

Once that is done, we can test that it works with sudo tcpdump --monitor-mode -i wlan1

3 replies

lennartkoopmann Mar 25, 2021
Maintainer

Thank you! See #347

choupit0 Aug 18, 2022

Once that is done, you should be able to cd .. and you will have all of the libpcap deb files in that directory. We then install the libpcap deb that we need sudo dpkg -i libpcap0.8_1.10.0-2_$arch.deb NOTE: you can use tab completion after the _ to complete the name if you do not know your architecture.

Once that is done, we can test that it works with sudo tcpdump --monitor-mode -i wlan1

I'm in the same case today, I'm using the chipset rtl8814au (Alfa AWUS 1900) on Kali 2022.3 (fresh install + lastest nzyme application 1.2.2).

So, I did exactly what you described here..., but now, each time I'm trying to launch a command, the shell/terminal emulator is freezes...

And the web page stays on this status:

Update: Ok, I just found this new parameter « skip_enable_monitor »… I think it could help me!
Update 2: Yes, I can comfirm, no more issue ! :)

iagotomas Mar 12, 2024

As an alternative to modify debian/control file, before running "apt-build-dep ." I used export with_libnl=yes to link libnl to the deb package.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

nzyme can't turn on monitor mode due to libpcap not being linked against libnl #339

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 6 comments 16 replies

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

Select a reply

nzyme can't turn on monitor mode due to libpcap not being linked against libnl #339

steev Mar 22, 2021

Replies: 6 comments · 16 replies

lennartkoopmann Mar 22, 2021 Maintainer

steev Mar 22, 2021 Author

lennartkoopmann Mar 22, 2021 Maintainer

steev Mar 22, 2021 Author

lennartkoopmann Mar 22, 2021 Maintainer

steev Mar 22, 2021 Author

steev Mar 22, 2021 Author

lennartkoopmann Mar 22, 2021 Maintainer

lennartkoopmann Apr 22, 2021 Maintainer

steev Mar 22, 2021 Author

steev Mar 23, 2021 Author

steev Mar 24, 2021 Author

steev Mar 24, 2021 Author

steev Mar 24, 2021 Author

lennartkoopmann Mar 25, 2021 Maintainer

choupit0 Aug 18, 2022

iagotomas Mar 12, 2024

steev
Mar 22, 2021

Replies: 6 comments 16 replies

lennartkoopmann
Mar 22, 2021
Maintainer

steev
Mar 22, 2021
Author

lennartkoopmann Mar 22, 2021
Maintainer

steev
Mar 22, 2021
Author

lennartkoopmann Mar 22, 2021
Maintainer

steev Mar 22, 2021
Author

steev Mar 22, 2021
Author

lennartkoopmann Mar 22, 2021
Maintainer

lennartkoopmann Apr 22, 2021
Maintainer

steev
Mar 22, 2021
Author

steev Mar 23, 2021
Author

steev Mar 24, 2021
Author

steev
Mar 24, 2021
Author

steev
Mar 24, 2021
Author

lennartkoopmann Mar 25, 2021
Maintainer