The Ethical Hacker Network - capturing packets from cellphone aircard

chrisj

Hero Member

Offline

Posts: 1163

capturing packets from cellphone aircard

« on: October 13, 2011, 12:55:01 PM »

I did quick scans of the forum and google, but couldn't find what I was looking for, so I thought I'd ask here.

Does anyone know how to capture PPP traffic from a cellphone AirCard Modem?

I'm trying to troubleshoot an issue that someone is having with VPN, and thought a packet capture via Wireshark would be helpful here.

The problem is, the box I'm using to test on has to get it's connection via a USB Aircard from a cell phone provider. WinPcap sees it as PPP traffic on Windows 7 and doesn't capture the data according to there FAQ.


	Logged

OSWP, Sec+

tturner

Sr. Member

Offline

Posts: 432

Re: capturing packets from cellphone aircard

« Reply #1 on: October 13, 2011, 01:07:04 PM »

Did you try Netmon? (i have not, but figured it's worth a shot)

You can always use nm2lp http://www.inguardians.com/tools/ to convert the netmon capture to libpcap format.


	Logged

Certifications:
CISSP, CISA, GPEN, GWAPT, GAWN, GCIA, GCIH, GSEC, OPSE, CSWAE, CSTP, VCP

WIP: OSWP, GSSP-JAVA, GXPN

Udacity on hold, again. I suck.

http://sentinel24.com/blog @tonylturner http://bsidesorlando.org

chrisj

Hero Member

Offline

Posts: 1163

Re: capturing packets from cellphone aircard

« Reply #2 on: October 13, 2011, 02:38:37 PM »

tturner: I haven't. My first thought when reading your post what's that. Time to google.

A friend of mine in irc suggested looking into usb capture tools too.

I'm not a windows person, if I was in linux, I'd just go with tcpdump and be done with it. Wink


	Logged

OSWP, Sec+

eth3real

Sr. Member

Offline

Posts: 309

Re: capturing packets from cellphone aircard

« Reply #3 on: October 18, 2011, 12:38:28 PM »

Quote

if I was in linux, I'd just go with tcpdump and be done with it.

And they never make Linux drivers! Sad


	Logged

Put that in your pipe and grep it!

chrisj

Hero Member

Offline

Posts: 1163

Re: capturing packets from cellphone aircard

« Reply #4 on: October 19, 2011, 12:48:22 AM »

Quote from: eth3real on October 18, 2011, 12:38:28 PM

Quote

if I was in linux, I'd just go with tcpdump and be done with it.

And they never make Linux drivers! Sad

When I looked at connecting my laptops and nokia n800 in the past, it was less an issue with the hardware, and more an issue with the software they use for tracking your traffic usage. I was able to do it between my phone and nokia in the past (different carrier). I could probably find how to do the same with the aircard. But I needed to test out the connection from a windows box. part of it was testing the profile I had.


	Logged

OSWP, Sec+

sil

Hero Member

Offline

Posts: 549

Re: capturing packets from cellphone aircard

« Reply #5 on: October 20, 2011, 09:11:33 AM »

Chris, in order to understand what you want and where you want it, here is a quickie diagram of a ppp setup:

Code:

Dead[1] --> Established[2] --> Auth[3] --> NLP(NCP negotiation)[4] --> Open[5] --> Terminated[6]

Most devices will begin between 1 and 3 which cannot be sniffed by outside devices as there is no IP going on yet. In order to see what occurs during the setup, you'd need to be in the path of the cellular and device doing the ppp transaction(s). You mention nokia, you can get a sniffer on that device and do some capturing to see what happens.

Now *after the ppp connection* (between 4 and 6) you would need to be somewhere sniffing either on the ppp device or through some insane port mirroring or other. Otherwise AFTER the fact, you're seeing IP (IPCP or IPE, etc). What you may be able to do is mirror the ppp server where the phone would go through the ppp setup by connecting to you first:

Code:

Phone[a] --> ppp[b] --> Nix device sniffing[c] --> relay[d] --> real PPP server[e]

In this setup, it would help to sniff on a, c and e. This way you can compare and see who is doing what, where and at which stage. Otherwise the data you may need to see (on the original ASCII diagram) 2,3,4 would never be seen unless you have something to decapsulate the ppp frames.

Anyhow, Nokia has their own packet capture application which should get you to a solid state of understanding what is going on: http://betalabs.nokia.com/apps/nokia-connectivity-analyzer


	Logged

http://www.infiltrated.net/mgz/puppylecter.jpg

chrisj

Hero Member

Offline

Posts: 1163

Re: capturing packets from cellphone aircard

« Reply #6 on: October 20, 2011, 12:01:29 PM »

Sil. We got off in the weeds... My comments about noikas were a rebuttal to eth3real's driver comment.

I was trying to find a way to capture the data in steps 4 - 6, to make sure that there wasn't a problem with the VPN Server (client / server).

Bit of an explanation on the original problem:
I set up a new vpn profile for a customer. but when ever the customer would try to connect he would get an immediate error response saying unknown problem at peer.

I needed to be logged in on my work laptpp, and was using my netbook as a test device using a verizon air card. I was getting the same error as the client when trying to connect. I wanted to see what the traffic looked like, to see if the problem was the pcf file, or on the server side. make sure that things were trying to establish and get a baseline to troubleshoot with to compare my side vs the customer's side.

And it all had to be done through Windows.

In the end, the whole thing ended up being a mess, and we ended up going a slightly different route that's working for now. (Problem on customer's end sending UDP traffic).


« Last Edit: October 20, 2011, 12:03:38 PM by chrisj »	Logged

OSWP, Sec+

chrisj

Hero Member

Offline

Posts: 1163

Re: capturing packets from cellphone aircard

« Reply #7 on: October 20, 2011, 12:02:10 PM »

thanks for the great writeup sil.


	Logged

OSWP, Sec+

sil

Hero Member

Offline

Posts: 549

Re: capturing packets from cellphone aircard

« Reply #8 on: October 20, 2011, 02:53:09 PM »

Quote from: chrisj on October 20, 2011, 12:01:29 PM

I was trying to find a way to capture the data in steps 4 - 6, to make sure that there wasn't a problem with the VPN Server (client / server).

In the end, the whole thing ended up being a mess, and we ended up going a slightly different route that's working for now. (Problem on customer's end sending UDP traffic).

Unf... VPN diagnosing is a PITA big time. Whenever I have to debug on say Juniper SSGs or better, I always want to pull my hair out since each side of a tunnel usually has to have every parameter EXACT.

You say UDP and in the initial post, I saw PPP,, are you doing L2TP? If so, I hope its L2TP over IPSEC, remember, L2TP doesn't encrypt if you didn't know this already. Reason for me asking is, I have a client in NYC, set up his own "tunnels" using L2TP alone where everything and its mother was sniffable.


	Logged

http://www.infiltrated.net/mgz/puppylecter.jpg

chrisj

Hero Member

Offline

Posts: 1163

Re: capturing packets from cellphone aircard

« Reply #9 on: October 20, 2011, 05:00:33 PM »

It's Cisco's VPN Client doing IPSEC over UDP. Usually people connect their "local" LAN. Be it Home or other location, and then "VPN in" for remote access.

In the case of my testing (where this all came from), I was in the offce and the aircard was the only way to simulate a connection while not on the network.


	Logged

OSWP, Sec+

Pages: [1] Go Up

« previous next »