I'm getting conflicting views about where wireshark should be used to sniff for traffic. Some say to use the gateway to do it and use it to capture non tor traffic, others say to use the workstation to do it. I am aware that there are leak tests where you do it on the gateway. But for the purpose of utmost anonymity and security where should it be done from? And what would the set up be? My drivers aren't loading in whonix at all when i launch wireshark. I used katoolin script to install kali tools on whonix virtualbox platform.
5
-
1"for the purposes of utmost anonymity and security where should it be done from?" A device upstream from the gateway, a distinct physical device that acts as a man-in-the-middle or another virtual machine can intercept the traffic outbound from the gateway. Since wireshark is itself vulnerable to exploitation by maliciously crafted packets, it should not be running on the same system as your gateway, which is the lynchpin in Whonix's security design and running it on the Workstation will not tell if you the gateway properly did it's job in stopping the packets getting out unfiltered.– cacahuatlCommented Feb 27, 2017 at 5:41
-
whonix.org/wiki/Dev/Leak_Tests | corridor, a Tor traffic whitelisting gateway, a clearnet leak tester - whonix.org/blog/corridor-a-clearnet-leak-tester | github.com/rustybird/corridor | whonix.org/blog/…– adrelanosCommented Feb 28, 2017 at 0:47
-
from what i understand researching this up till now. it seems you can't get wlan0 to be recognized since the whonix framework is built on the internal whonix network with the exception of the gateways outward nat configuration. all we have available from this set up atleast is eth0 & lo. please somebody correct me if im wrong. I also dont think it wise to add a bridged network to the workstation either. even tho which would at least have my wlan0 be recognized it would defeat the purpose of whonix anonymity. Or is it better than running ubuntu thru the whonix gateway for anonymity? Thank you– lollipopCommented Mar 1, 2017 at 13:36
-
What are you trying to capture? From the POV of packets that might leak, listening outside and upstream of the gateway work workstation is the best choice to be sure that the traffic seen is egress traffic (not a packet that was picked up by pcap but dropped by iptables). To that end, capturing on wlan0 is pointless. If you goal however is to be script kiddie and try wifi hacking like it was the early 00s, then whonix simply isn't a good choice for that.– cacahuatlCommented Mar 1, 2017 at 20:15
-
i think my goal would be to not be a script kiddie. btw since when "was" the early 00's. haha. as far as whonix is concerned, i don't think wlan0 is really an option on workstation. u cant get it unless you change the adapter from internal to bridged. sadly, my computer doesnt even have virtualizaton. so 3d acceleration isn't an option either, which i also think is recommended against from documentation. it seems the answer is different hardware. or qubes.– lollipopCommented Mar 1, 2017 at 23:24
Add a comment
|
1 Answer
Since Wireshark is to be used for analyzing local Network traffic, using Whonix in this case will not yield you any Advantage in regards to security. Adding to that, please Keep in mind that you should only use such Software on Networks you are allowed to pen-test, in which case anonymity shouldn't be required.
-
i beg to differ. I say every avenue of thought can lead to a picture more whole than the last. every stroke counts, ive learned in life. Isn't this the spirit of "pen-testing?"– lollipopCommented Mar 1, 2017 at 12:56
-
and of course here you are telling me what should be in my mind! the sun really is in the yeast.– lollipopCommented Mar 1, 2017 at 12:57