1

Like the headline says: is this possible in Linux at all? How would one implement a completely silent packet sniffer? I would like to take the interface away and give it back to the OS at will, if this is possible. Currently the OS gets in the way because eth0 being the only network interface on the machine in question, Linux tries to ask for connectivity by DHCP.

1

Yes, this is at least partially possible.

First, you need to figure out the "interface name" of the interface. The command ifconfig -a (possibly /sbin/ifconfig -a) shows you all the interfaces. Choose wisely.

Second, you have to identify and stop the process that's using DHCP on that interface. This could be dhcpcd, dhclient or maybe even pump. Run ps -ef to try to identify the process IDs of such processes. Use kill -QUIT to stop them. Bear in mind that your setup may restart the DHCP client at the next reboot.

You should look in /var/run to find "PID files". For instance, my Arch linux laptop has a file /var/run/dhcpcd-wlp12s0-4.pid which contains the process ID of the dhcpcd process that manages the "wlp12s0" interface. That's a wireless card, but the same sort of file will exist for an ethernet card.

If you're hoping to sniff wireless packets, you're better off using [kismet][1] or [airodump-ng][2]. Follow the tutorials - usage isn't exactly easy or obvious.

If you're hoping to sniff ethernet packets without being detected, you should be aware that some controversy exists about whether this is possible or not. Using a "read only" cable would prevent some of the methods of promiscuous-mode interface detection. This method worked for me, some people say it doesn't work all the time. You do need two ethernet interfaces to read traffic going both ways.

2
  • There is no need to stay invisible, but as this is a ethernet used as bus between realtime-communicating PCBs I shouldn't disturb the data transmission. The task is to record the stream of measurement data. Mar 17 '15 at 20:20
  • 1
    You could consider using something like the throwing star lan tap: greatscottgadgets.com/throwingstar which you place in-line in a network connection. You then need two free network interfaces, one for sniffing each direction. That way you are guaranteed not to send any data on that connection. Only gotcha is that the speed it limited to 100Mb/s.
    – wurtel
    Mar 18 '15 at 9:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.