ettercap prob slack11 suspect libnet

hi everyone,
im having a problem using ettercap on slackware 11, i didnt use to have (eg. its facing me the first time)


when i run:
ettercap -T -M arp:remote -i ath0 -q /host/ /router/

and after that i start the check poisoning plugin (chk_poison)
it gives me

chk_poison: Checking poisoning status...

ERROR : 1, Operation not permitted
[ec_send.c:send_L3_icmp_echo:513]

libnet_write (-1): libnet_write_raw_ipv4(): -1 bytes written (Operation not permitted)


iptables v1.3.5: can't initialize iptables table `nat': Permission denied (you must be root)
Perhaps iptables or your kernel needs to be upgraded.
iptables v1.3.5: can't initialize iptables table `nat': Permission denied (you must be root)
Perhaps iptables or your kernel needs to be upgraded.
iptables v1.3.5: can't initialize iptables table `nat': Permission denied (you must be root)
Perhaps iptables or your kernel needs to be upgraded.
iptables v1.3.5: can't initialize iptables table `nat': Permission denied (you must be root)
Perhaps iptables or your kernel needs to be upgraded.
iptables v1.3.5: can't initialize iptables table `nat': Permission denied (you must be root)
Perhaps iptables or your kernel needs to be upgraded.
iptables v1.3.5: can't initialize iptables table `nat': Permission denied (you must be root)
Perhaps iptables or your kernel needs to be upgraded.
iptables v1.3.5: can't initialize iptables table `nat': Permission denied (you must be root)
Perhaps iptables or your kernel needs to be upgraded.
iptables v1.3.5: can't initialize iptables table `nat': Permission denied (you must be root)
Perhaps iptables or your kernel needs to be upgraded.
iptables v1.3.5: can't initialize iptables table `nat': Permission denied (you must be root)
Perhaps iptables or your kernel needs to be upgraded.

ip_forwarding was disabled, but we cannot re-enable it now.
remember to re-enable it manually


and it crashes, i have libnet for slackware 11 installed from source (1.1.2.1).
i have however another box running slack 10.2 which uses the same and it is working nice.

i noticed it worked when i compiled libnet from source, (after having it as package), after that and without any warnings it started giving me the same error again (the one mentioned).
i even tried backtrack which used to do it succesful and also the same error. (maybe hardware :confused: although its new hardware)

but i noticed that regardless of the check_poison error, it indeed did a an arp poisoning ( i checked it on the machine im testing)

any help is appreciated
thank you

Are you serious???

Quote:

---

Permission denied (you must be root)

---

Does this perhaps offer you a clue as to what the problem could be?

--TH13

thanks for you reply,
im running it as root, but it says that (iptables thingy) probably because of privileges dropping. :)

If you're running as root and you're seeing these messages, there are more issues with your host than you're aware of. Being denied access to shared libraries (and other things) when you're logged in as root is not a good sign my friend.

ok, but its a *fresh* install of slack11, and what about backtrack -running live- giving this error?

Fresh install fully patched?

Hmmmm,

Not my area at all, but as a general fault finding thing, given that you have a new machine and new software?

Try mirroring your working 10.2 setup onto the new box............ at least that should give you a good idea of whether it is some sort of hardware, firmware, driver issue or something else?

The problem that I have found with high level error messages is that they can be very deceptive if you have some low level or incompatibility problem?

Just a few thoughts on general principles --TH13 knows the ins and outs of the actual applications ;)

I'm certain the issue isn't with the OS itself, rather, the versions of libraries and such that are in use with Ettercap or a config issue. This app is VERY specific about what needs to be present before it will work.

That said, if this host is FULLY patched and freshly installed, I would go to the ettercap forums on sourceforge and report the issue to the development team. Still, the fact that root can't access a shared library is disturbing to me. Perhaps there is a bug in Ettercap but I would first check to see if the user is set to root in the etter.conf file. Are you running their latest release? Did you compile anything specific into it?

Anyway, http://ettercap.sourceforge.net and visit the support forums.

--TH13

nihil: thanks, will try to do that
th13:my system is patched. altough i dont think of it as a compromise since backtrack gives the same thing. I edited etter.conf and set the uid and gid dropped to, to 0 (root) and it stopped giving the error about iptables, but still the libnet error.

OK, half the problem is solved. Now all you have to do is look at the perms on the libnet files. Does root have rights to them? If so, you may have a bug on your hands. Best bet at that point is to report the libnet error to the developers on the ettercap forum.

--TH13

checked permissions, root had exec permissions but still gives me the
error :(

Is that the only perm you have? What about read?

sure read also

ok, so i tested slack 10.2 on my laptop, and it worked!
i also noticed that nemesis on slack11 can succesfully inject the same packet, (nemesis depends on libnet), so i dont think its a problem with libnet.

Hi,
the problem is still giving the same error, i updated a while ago my main box to slack11, and
the problem occured there also! if anyone can help me regarding this problem im very thankful.

attached strace log of ettercap, for the uber- geeks to diagnose it.
any help is appreciated

thank you.

Have you reported this to the ettercap folks on their forum page yet? I would certainly let them know. Also, I'm sure there is a debug switch somewhere in the conf. You may want to set that, run the app, capture the error and submit it up to them.

--TH13

I recompiled the program in debug mode, reproduced the situation, and sent them the backtrace,
ettercap-NG-debug.log, pcap file. Hope it will help.
Meanwhile, if anyone has any suggestions, im more than welcome.

thank you

Hello,
have you solved this problem ? I have the same and I keep looking for a soution but I cant find any !

the ettercap geeks didnt send me a reply yet :(