libtins ARP request detection

Question

First, I am a novice, so be gentle.... I am using a wrapper for the libtins library. I want to be able to detect arp requests and get the mac address of the sender. I have linked libtins and have my code going, I am able to detect dot11frameBeacons and get the hardware address so I have everything structurally OK (I think).

Here is my code for registering the ARP requests

  class ofxSnifferARPRequestFrame {
public:
    bool isValid = false;

    string ssid;
    HWAddress<6> addr;

    ofxSnifferARPRequestFrame() {}

    ofxSnifferARPRequestFrame(Packet packet) {
        try {
            packet.pdu()->rfind_pdu<Tins::ARP>();
            cout<<"ARP REQUEST RECEIVED"<<endl;

            const Tins::ARP &data = packet.pdu()->rfind_pdu<Tins::ARP>();

            addr = get_dst_addr_ARP(data);
            isValid = true;
        } catch (...) {
        }
    }
};

I get no response when I initialise a wifi device (however in the same program I do get constant notifications of dot11 frame beacons). When I use the same device to connect to my network while I monitor it with wireshark I see the arp request. Any clues as to what I am doing wrong would be great. I thought that this line

            packet.pdu()->rfind_pdu<Tins::ARP>();

would find the arp request.

For reference here is the corresponding code that works to get the dot11 frame beacons.

class ofxSnifferProbeRequestFrame {
public:
    bool isValid = false;

    string ssid;
    HWAddress<6> addr;

    ofxSnifferProbeRequestFrame() {}

    ofxSnifferProbeRequestFrame(Packet packet) {
        try {
            packet.pdu()->rfind_pdu<Tins::Dot11ProbeRequest>();


            const Tins::Dot11ManagementFrame &data = packet.pdu()->rfind_pdu<Tins::Dot11ManagementFrame>();
            ssid = data.ssid();
            addr = get_src_addr(data);
            isValid = true;
        } catch (...) {
        }
    }
};

Cheers

score 0 · Answer 1 · answered Dec 27 '15 at 14:22

Ok, this was not so complicated, I was initialising my sniffer with monitor mode enabled, to listen to ARP requests the sniffer should not have monitor mode enabled. My init code is not in the initial question and made this impossible to solve from the code I posted- my mistake.

I solved this by checking again with wirecast and noticing that when I was receiving arp request notifications my wifi was not in monitor mode.

libtins ARP request detection

1 Answers1