Search code examples
clinuxnetwork-programminglibpcappacket-sniffers

Is it possible to inject on a raw socket while sniffing in promiscous mode?

I'm writting a program which sniffs out traffic with libpcap only to take out packets to modify and inject back into the network with a raw socket. I know that for normal promiscous mode operation of a wireless card, your not suppose to be able to interact with the network, but is it possible to do it with raw sockets?

Solution

  • The short answer is yes. Below is the longer one...

    I know that for normal promiscous mode operation of a wireless card, your not suppose to be able to interact with the network

    I am not sure where you have got this knowledge from but the above statement is wrong. A promiscuous mode does not restrict what you can do and how you can interact with the network. By default, network interface cards are simply trying to reduce the amount of data they pass to the host for better efficiency. For example, NICs would not pass an Ethernet frame to the host if its destination MAC address does not match the address of the receiving media access controller. The only thing that promiscuous mode does is simply tells the device to pass everything it gets to the host, be that frame addressed for the host or not. In other words, whatever you were able to do with NIC in a normal operation mode, you can still do when it is in promiscuous mode. Plus, NIC does not filter anything for you anymore, so you can receive more (as long as the host can handle the load).

    but is it possible to do it with raw sockets?

    Yes, it is possible. As long as you have enough privileges, you can send and receive Ethernet frames from user-space using "raw" sockets API. Whether a devices is in promiscuous mode or not does not make any difference.

    Also note that these days routers are very smart and they won't forward packets to your host even if you put your host's NIC into promiscuous mode. So in the right network your are not likely to receive anything that in fact is not intended for your host, and promiscuous mode won't make any difference.

    If that helps, here is a simple example of exchanging custom packets with an FPGA board connected to the PC over Ethernet. It uses raw socket API and runs in user-space on Linux.