Hcxdumptool - How to capture one network data only?

[darkside]

I read help for hcxdumptool, tried to find something online. But no luck.
I assume that I don't understand something in hcxdumptool --help

If I have network called randomnet

How Can I use hcxdumptool only against this network?

[ZerBea]

hcxdumptool doesn't use network names (because this names are not unique).
Instead it use the BSSID (MAC) of teh AP.
How to get the MAC is descriped in --help:

Code:

--filterlist_ap=<file or MAC>      : ACCESS POINT MAC or MAC filter list
                                     format: 112233445566, 11:22:33:44:55:66, 11-22-33-44-55-66 # comment
                                     maximum entries 256
                                     run first --do_rcascan to retrieve information about the target

--filtermode=<digit>               : user space filter mode for filter list
                                     mandatory in combination with --filterlist_ap and/or --filterlist_client
                                     affected: only outgoing traffic
                                     notice: hcxdumptool act as passive dumper and it will capture the whole traffic on the channel
                                     0: ignore filter list (default)
                                     1: use filter list as protection list
                                        do not interact with ACCESS POINTs and CLIENTs from this list
                                     2: use filter list as target list
                                        only interact with ACCESS POINTs and CLIENTs from this list
                                        not recommended, because some useful frames could be filtered out
                                     using a filter list doesn't have an affect on rca scan
                                     only for testing useful - devices to be protected should be added to BPF
                                     notice: this filter option will let hcxdumptool protect or attack a target - it is neither a capture nor a display filter

add the MAC to a list (e.g. name it filter.list
run hcxdumptool with option --filtermode=2 and --filterlist_ap=filter.list

Additional information is here:
https://www.youtube.com/watch?v=Usw0IlGbkC4

[darkside]

hcxdumptool doesn't use network names (because this names are not unique).



Instead it use the BSSID (MAC) of teh AP.



How to get the MAC is descriped in --help:

Code:

--filterlist_ap=<file or MAC>      : ACCESS POINT MAC or MAC filter list



                                    format: 112233445566, 11:22:33:44:55:66, 11-22-33-44-55-66 # comment



                                    maximum entries 256



                                    run first --do_rcascan to retrieve information about the target







--filtermode=<digit>              : user space filter mode for filter list



                                    mandatory in combination with --filterlist_ap and/or --filterlist_client



                                    affected: only outgoing traffic



                                    notice: hcxdumptool act as passive dumper and it will capture the whole traffic on the channel



                                    0: ignore filter list (default)



                                    1: use filter list as protection list



                                        do not interact with ACCESS POINTs and CLIENTs from this list



                                    2: use filter list as target list



                                        only interact with ACCESS POINTs and CLIENTs from this list



                                        not recommended, because some useful frames could be filtered out



                                    using a filter list doesn't have an affect on rca scan



                                    only for testing useful - devices to be protected should be added to BPF



                                    notice: this filter option will let hcxdumptool protect or attack a target - it is neither a capture nor a display filter

add the MAC to a list (e.g. name it filter.list



run hcxdumptool with option --filtermode=2 and --filterlist_ap=filter.list







Additional information is here:



https://www.youtube.com/watch?v=Usw0IlGbkC4

Thank you.



I tried with --filterlist_ap but no luck.



I tried this:






hcxdumptool -i wlp0 --filterlist_ap=XXXXXXXXXXXX -o dump.pcapng --enable_status=31 --filtermode=2





I tried with --filterlist_ap=list.txt too







No luck.



The difference between filter and no filter is that without the --filterlist_ap= hcxdumptool is gathereing everything.

With the hcxdumptool --filterlist_ap= it gathers less targets.

MAC I want to target is on the list but it shows after some time.



This MAC is my home router.

[ZerBea]

Ok, that makes it a little bit more clear.

hcxdumptool has three level:
1) receive (capture) everything and transmit (send attack frames) everything.
2) receive (capture) everything and filter transmitted packets only (done by filtermode and filter list options).
3) filter incoming and outgoing traffic - this is done by a Berkeley Packet Filter BPF.
My first answer belongs to level 2.

Here is the answer for level 3:

Code:

$ sudo hcxdumptool -i <interface> --do_rcascan
to get information about target MAC and operation channel of the target
$ sudo hcxdumptool -m <interface>
set interface to monitor mode
$ sudo tcpdump -i <interface> wlan addr1 11:22:33:44:55:66 or wlan addr2 11:22:33:44:55:66 or wlan addr3 11:22:33:44:55:66 -ddd > attack.bpf
where 11:22:33:44:55:66 is your target MAC.
run hcxdumpttool:
$hcxdumptool -i  <interface> -o dump.pcapng --enable_status=31 --bpfc=attack.bpf

Please notice:
When you convert this dump file you receive a warning, because broadcast frames are filtered out and you will loose some interesting frames.
To avoid this, you can expand the filter to:

Code:

$ sudo tcpdump -i <interface> wlan addr1 11:22:33:44:55:66 or wlan addr2 11:22:33:44:55:66 or wlan addr3 11:22:33:44:55:66 or WLAN addr3 ff:ff:ff:ff:ff:ff -ddd > attack.bpf