监控模式接口上的 tcpdump - 未捕获任何内容
我一直在使用 tcpdump（版本 4.1.1）尝试从 监控模式界面由 airmon-ng 设置。我说“尝试”是因为到目前为止还没有发生任何事情。这很奇怪：
tcpdump -i mon0
上面的命令工作正常。我看到所有信标和探测请求以及所有其他可以想象到的帧都显示在我的屏幕上。 将输出写入捕获文件时，
但是，当我尝试使用tcpdump -i mon0 -w captures.cap
绝对不会捕获任何内容，包括包含 的第 3 层数据包实际数据。当我杀死 tcpdump 时，它给我
捕获了 13507 个数据包
过滤器收到 13507 个数据包
内核丢弃了 0 个数据包
（在本例中 13507 是任意数字）和一个完全空的捕获文件。
但是，当我在同一接口上使用 tshark 或wireshark 执行捕获时，帧会被捕获到文件中，没有任何问题。
我更喜欢使用 tcpdump 而不是wireshark，因为它没有 GUI 的开销，并且具有“-z”选项，允许我获取捕获文件并将其传递给 shell 脚本，然后将其复制到另一台计算机在我的网络上。 tshark 或wireshark 没有类似的功能，我非常希望避免编写程序来检查捕获文件是否存在。
我对 tcpdump 的工作方式是否有根本性的误解，或者这里肯定发生了一些奇怪的事情？是否有更好的方法来完成我正在做的事情，或者我是否必须编写自己的基于 libpcap 的捕获程序？
I've been using tcpdump (version 4.1.1) to attempt to capture wireless frames from a monitor mode interface set up by airmon-ng. I say "attempt" because so far nothing has been happening. It's very odd:
tcpdump -i mon0
The above command works fine. I see all the beacons and probe requests and every other frame imaginable displayed across my screen. However, when I attempt to write the output to a capture file using
tcpdump -i mon0 -w captures.cap
absolutely nothing gets captured including layer 3 packets that contain actual data. When I kill tcpdump, it gives me
13507 packets captured
13507 packets received by filter
0 packets dropped by kernel
(13507 is an arbitrary number in this case) and a completely empty capture file.
However, when I perform capturing with tshark or wireshark on the same interface, frames are captured to files without any problems.
I would prefer to use tcpdump instead of wireshark as it doesn't have the overhead of a GUI and it has the "-z" option which allows me to take the capture file and pass it to a shell script that copies it to another computer on my network. There is no similar functionality with tshark or wireshark and I would very much like to avoid writing a program to check for the existance of a capture file.
Do I have a fundamental misunderstanding with the way tcpdump works or is there definitely something odd going on here? Is there perhaps a better way of doing what I'm doing or am I going to have to write my own libpcap-based capture program?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
你试过airodump-ng吗？
不确定它是否使用 libpcap 作为捕获库，但使用 pcap 文件格式，并且有许多用于通道选择、bssid 过滤等的选项。
Have you tried airodump-ng?
Not sure if it uses libpcap as capture library, but is uses pcap file format and has many options for channel selection, bssid filtering etc.
看起来确实有些不对劲。在我的 Ubuntu 上，以下内容运行良好。
也许你可以试试
JP
Seems effectively something wrong. On my Ubuntu the following works well.
Perhaps you can try
JP