node_pcap icon indicating copy to clipboard operation
node_pcap copied to clipboard

Unable to decode packets

Open DarrenRainey opened this issue 4 years ago • 4 comments

Currently I'm having the following error when ever I try to decode any packets: I installed pcap via npm i pcap

/root/node_modules/pcap/decode/ieee802.11/radio_packet.js:86
            throw new Error('Radiotap Namespace / Vendor Namespace not implemented yet');
            ^

Error: Radiotap Namespace / Vendor Namespace not implemented yet
    at buildDecoder (/root/node_modules/pcap/decode/ieee802.11/radio_packet.js:86:19)
    at RadioPacket.decode (/root/node_modules/pcap/decode/ieee802.11/radio_packet.js:57:37)
    at PcapPacket.decode (/root/node_modules/pcap/decode/pcap_packet.js:46:54)
    at Function.decode [as packet] (/root/node_modules/pcap/decode/index.js:11:36)
    at PcapSession.<anonymous> (/root/test.js:8:26)
    at PcapSession.emit (events.js:198:13)
    at PcapSession.on_packet_ready (/root/node_modules/pcap/pcap.js:107:10)
    at PcapSession.session.read_callback (/root/node_modules/pcap/pcap.js:72:45)

This is the code I'm trying to test:

var pcap=require('pcap');
pcap.createSession("wlan0mon", '(type mgt) and (type mgt subtype probe-req )').
        on('packet', function (raw_packet) {
                with(pcap.decode.packet(raw_packet).link.ieee802_11Frame)
                        if (type == 0 && subType == 4)
                                console.log("Probe request",shost, "-> ",bssid);
        }
);

DarrenRainey avatar May 23 '20 19:05 DarrenRainey

hello, if you're still hitting the problem please send us a .pcap of that interface, or the bytes of raw_packet which fails decoding

mildsunrise avatar Sep 06 '20 07:09 mildsunrise

hello, if you're still hitting the problem please send us a .pcap of that interface, or the bytes of raw_packet which fails decoding

Unfortunately I don't have a pcap file as I'm streaming directly from my wifi card I did some research on this a while ago and apparently it has something to do with the api change between v2 and v3 although I haven't gotten around to rewriting it yet.

DarrenRainey avatar Sep 06 '20 11:09 DarrenRainey

Can confirm, ran into this issue today. Only happens when trying to decode the packet; leaving in raw works fine :/

About7Sharks avatar Nov 09 '20 21:11 About7Sharks

please, send us a .pcap with the captured packets (you can obtain one with i.e. wireshark or tcpdump)

mildsunrise avatar Nov 09 '20 22:11 mildsunrise