Cain and Linksys Router

Please forgive me if I post this in the wrong area.

I downloaded Cain and am trying to see if I can get it to work on my network. I am connected via WiFi to my Linkssy WRT54GS Router, and I am trying to Poison it and pick up my passwords as they are sent through the router. Unfortuantly, when I attempt to sniff for IP Addy's, nothing shows up even though they are in the correct range. I tried this on a computer at my church and they use a NetGear Router, so I am pretty sure its a setting on my router. Thank you for your help.

-={Nan0click}=-

Is there any traffic going on in your network?

Quote:

---

I tried this on a computer at my church and they use a NetGear Router, so I am pretty sure its a setting on my router.

---

I don't think your god will be happy with you on that one! :p

-kurt

Its not like I'm doing this for malicious reasons. Its a serious family reason (not joking) and so inbetween times I care about this person enough to get information about them I can play funny jokes on them.

Yes, there is traffic, I have WAN access, and I have network access. Its a PITA though because for some reason, I can never do anything like get remote registry or whatever with the cmd net use command. the command goes thorugh, but nothing happens. I THINK its router, but it might be some setting I have. I have WinXP Pro SP2 (necessary evil) and the two other computers have WinXP Home.

This is basic networking,

Not all traffic can go over routers, some of these things include....

1. DHCP - unless the router is the DHCP server, DHCP request will not be forfilled on the other side of the network.

2. Any kind of broadcast - etc net send

This could well be the problem, and it is fixable. But it depends on whether wireless routers support this function or whether you can install the function into the linksys WRT54G, you can get a firmware update for it but im not sure if it will help


doyle

Quote:

---

Originally posted here by Modderfokker
This is basic networking,

Not all traffic can go over routers, some of these things include....

1. DHCP - unless the router is the DHCP server, DHCP request will not be forfilled on the other side of the network.

2. Any kind of broadcast - etc net send

This could well be the problem, and it is fixable. But it depends on whether wireless routers support this function or whether you can install the function into the linksys WRT54G, you can get a firmware update for it but im not sure if it will help


doyle

---

If he's connected to a linksys router then he's in the same broadcast domain and should see any broadcast data even without poisoning it. Net send doesn't really have anything to do with being a broadcast, except in the terms of a MS domain. It rides in a TCP protocol I believe.

What he is trying to do is to poison the arp cache (or atleast what I gather), which doesn't really have anything to do with broadcasts. I'm not sure why this doesn't work, but I would venture to guess that since most traffic is destined to the WAN port, that the internal switch cannot have that IP/MAC poisened, being that its part of the same unit.

I'm unsure why you can't get it to work. I'm able to get it to work on my linksys wrt54g connected via wireless... I'm able to poision/sniff with no problems at all. Are you sure you are doing it properly? I know its an easy tool.. but do you have the correct interface/device chosen?

I selected the device in Cain Config with my appropriate IP address, my ethernet port is disabled too. Based on what the people over at Jinx said, the router is not a switch. I am unsure how to make the router a "switch." Also, maybe this problem stems from WinPcap, not my router. I have the newest version installed, and I am not what, if any, kind of configuration should be done.

I am also using port fowarding, and that might affect it. I am really stumped.

Thanks for the replies,
nan0click

Right from Linksys's site on the model you mentioned

Internet-sharing Router, 4-port Switch, and performance enhanced Wireless-G (802.11g) Access Point

The 4 ports together are a switch, and the WAN port goes through the router. Who is this jinx group and what did they think it was since they said it wasn't a switch?

I wondered that as well, I googled it like a good person, and found it is a switch. I just felt it is aways good to post what I am told accross forums that way everyone is on the same track.

This may help:

http://www.irongeek.com/i.php?page=videos/cain1

I've watched all your videos. That one is saved to my computer actually. The ARP video you have is what actually made me want think about trying this. The issue might be my computer, I am unsure. When I get the chance, I will try this on a different computer on my network and see where the problem lies. If it is my computer, are there any special network proticols I need to have installed other than netmon?
Thanks

Are you on the same vlan/subnet? Also, does your card support promiscuous mode?

From what I've seen yes. I had an old computer networked to my Lan jack on my mobo, and bridged the LAN with the WiFi, and so the old computer worked on the internet and showed up in the router's DHCP table. Do I need to activate this form of operation, or if it exists, should it already be turned on?
I also would like to add that I have Norton Personal Firewall and have tried Cain with it both on and off. Also, I use Wireless Zero Configuration (just found the driver file on the CD when installing) and today tried the Linksys App, and found that CnA does not read the IP from it at all.

Cain should turn on promiscuous mode automatically. Does you laptop have a Centrino 802.11b (IPW2200) chipset in it? If so, it does not seem to support promiscuous mode in Windows (at least on my laptop).

Acutally, I have Wifi on my desktop because it is too hot outside right now for me to go drop wires in my attic, its a wmp54g pci card. I've done a lot of googling, and found an article on Microsoft about how to force compatibility mode for a wifi card, but this appears to work only when the ethernet port and the wifi adapter are bridged.

EDIT

While doing some troubleshooting, I have discovered that the wmp54g is probably not compatible with promiscuous[sp] mode. I have run a long lan cable to the router and volia! it works.

This makes the question then, how can I get the WMP54g to operate in promiscous mode?

Don't know, in Linux it may be supported but then you can't run Cain.

Well, I guess I'm off to go learn how to "properly" drop CAT5E cables... Thanks everyone for your help. Thanks Irongeek for those awesome video tutorials, I think your website is one of the coolest things I've seen (content-wise :D)

If you know someone willing to do pretty html for free I'm listening. :)