search

LeeBrotherston / tls-fingerprinting

TLS Fingerprinting
GNU General Public License v3.0
373 stars 81 forks source link

Virtual interfaces #13

Closed eeknay closed 8 years ago

eeknay commented 8 years ago

Hey,

I have an issue on one of my boxes with virtual interfaces. I can't seem to get it to work an it shows me the error "(null) is not an ethernet".

LeeBrotherston commented 8 years ago

Virtual interfaces, as in interfaces within vmware, virtualbox, xen, etc?

Or are you talking in the eth0:0 sense?

LeeBrotherston commented 8 years ago

I have done a little digging into this, and that error is a libpcap error regarding opening the interface.

I was expecting that opening eth0 (the physical to the virtual eth0:0, eth0:1, etc) would capture all virtuals, however when I tried to replicate the issue on a test machine I was able to operate on a virtual interface.

I suspect that this is a libpcap issue. Can I confirm the version of libpcap you are using please?

eeknay commented 8 years ago

I've got libpcap-dev (1.5.3-2) on some Parallels Virtuozzo virtualization.

LeeBrotherston commented 8 years ago

I have setup an Ubuntu box with libpcap-dev 1.5.3-2 and a virtual interface (eth0:0) within VMWare and it seems to work. So I'm not sure why you are experiencing the issue.

Maybe I have accidentally fixed this, are you running the latest version from the git repo?

eeknay commented 8 years ago

I just checked. I have the same libpcap-dev version.

Curiously, tcpdump works on the interface.

eeknay commented 8 years ago

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:65536 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

venet0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:127.0.0.1 P-t-P:127.0.0.1 Bcast:0.0.0.0 Mask:255.255.255.255 UP BROADCAST POINTOPOINT RUNNING NOARP MTU:1500 Metric:1 RX packets:164648 errors:0 dropped:0 overruns:0 frame:0 TX packets:164361 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:65859172 (65.8 MB) TX bytes:56162962 (56.1 MB)

venet0:0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr: x.x.x.x P-t-P:x.x.x.x Bcast:x.x.x.x Mask:255.255.255.255 UP BROADCAST POINTOPOINT RUNNING NOARP MTU:1500 Metric:1

eeknay commented 8 years ago

The error occurs on either venet0 and on venet0:0

LeeBrotherston commented 8 years ago

Interesting, as this happens on venet0 also, not just venet0:0, I wonder if it could be something peculiar to the venet interface type. I'll do some investigation, thanks!

LeeBrotherston commented 8 years ago

I have made a number of improvements/fixes the past few months and this seems to be working on my test linux equipment, but I don't want to close the issue until it works for you.... Does the current github version look any better for you?

LeeBrotherston commented 8 years ago

I can't replicate this with the current version.

If you are still experiencing the issue please reopen the issue and I'll happily deal with it!