View Issue Details

IDProjectCategoryView StatusLast Update
0002631Kali Linux[All Projects] General Bugpublic2016-02-18 13:00
Reporterdimitriosz Assigned Torhertzog  
PriorityhighSeveritymajorReproducibilityalways
Status resolvedResolutionfixed 
Product Version2.0 
Target VersionFixed in Version2016.1 
Summary0002631: dnsspoof issues
Descriptiondnsspoof no longer working independently or within ettercap (CLi) as a plugin. It used to work fine within Kali v1.x but not in Kali 2.x.

Activities

raimund

2015-11-21 10:38

reporter   ~0004259

This is because dnsspoof in Kali 2.x has response times of up to 500ms. So it is impossible to win the race against the real DNS server.

I tried linking dnsspoof against an older libpcap.so.1.3.0 - and the response times became extremly fast again (<=1ms) \o/

So my workaround is LD_PRELOAD=/usr/lib/x86_64-linux-gnu/libpcap.so.1.3.0 dnsspoof ...

rhertzog

2015-12-07 13:55

administrator   ~0004385

Can you try to install http://http.kali.org/pool/main/libp/libpcap/libpcap0.8_1.7.4-2_amd64.deb (or the same package for "i386" if you use a 32 bit system) and see if the issue persists ?

Or better, can you reproduce the issue with kali-rolling ? You can grab a kali-rolling ISO here:
http://archive.kali.org/kali-daily-images/kali-linux-rolling-amd64.iso

rhertzog

2015-12-07 14:24

administrator   ~0004388

After download you can use "dpkg -i libpcap0.8_1.7.4-2_amd64.deb" to install the package.

humanistmoon

2015-12-09 08:34

reporter   ~0004389

I installed libpcap0.8_1.7.4-2_i386, but not working.

raimund

2016-01-07 15:43

reporter   ~0004475

Hmmm ... http://archive.kali.org/kali-daily-images/kali-linux-rolling-amd64.iso:
403: Forbidden

rhertzog

2016-01-07 15:50

administrator   ~0004476

raimund, URL should be working now.

raimund

2016-01-08 10:43

reporter   ~0004483

Unfortunately with the rolling.iso and/or with libpcap0.8_1.7.4-2_amd64.deb the problem still exists.

rhertzog

2016-01-13 11:18

administrator   ~0004502

A proper fix for dnsspoof might be to call pcap_set_immediate_mode() which will force fallback to the TPACKET_V2 interface which does not delay sending packets like the default TPACKET_V3 interface. I would like to submit this suggestion to the upstream developers but it looks like that the dsniff package is no longer maintained...

In the mean time, I have modified libpcap to use TPACKET_V2 by default. raimund, can you install this package and report back if it fixes the issue?

http://repo.kali.org/kali/pool/main/libp/libpcap/libpcap0.8_1.7.4-2kali1_amd64.deb

Thank you.

Sara

2016-01-27 11:45

reporter   ~0004625

Hi! Newbee here and with Kali. I tried your package (i386) en it worked for me. Thanks!

rhertzog

2016-02-18 13:00

administrator   ~0004716

Fixed in libpcap 1.7.4-2kali1

Issue History

Date Modified Username Field Change
2015-09-08 23:54 dimitriosz New Issue
2015-11-21 10:38 raimund Note Added: 0004259
2015-12-04 22:29 alexhj451 Issue cloned: 0002902
2015-12-07 13:55 rhertzog Note Added: 0004385
2015-12-07 13:55 rhertzog Assigned To => rhertzog
2015-12-07 13:55 rhertzog Status new => feedback
2015-12-07 14:24 rhertzog Note Added: 0004388
2015-12-09 08:34 humanistmoon Note Added: 0004389
2016-01-07 15:43 raimund Note Added: 0004475
2016-01-07 15:50 rhertzog Note Added: 0004476
2016-01-08 10:43 raimund Note Added: 0004483
2016-01-13 11:18 rhertzog Note Added: 0004502
2016-01-27 11:45 Sara Note Added: 0004625
2016-02-18 13:00 rhertzog Note Added: 0004716
2016-02-18 13:00 rhertzog Status feedback => resolved
2016-02-18 13:00 rhertzog Fixed in Version => 2016.1
2016-02-18 13:00 rhertzog Resolution open => fixed