-
Notifications
You must be signed in to change notification settings - Fork 0
Wired LAN and Packet Capture
Qwavey edited this page Aug 23, 2026
·
1 revision
Sniffing, tracing, scanning, and the USB attach/detach watcher.
Every command block below is that script's own --help output on the real device, pulled straight from its header comment - not retyped.
-
sniff.sh- LAN packet sniffer, with a bridge/tap mode for a two-NIC PC-through-Pager setup. -
tracer.sh- Live, continuously-scrolling packet trace (watch traffic as it happens). -
pc_link.sh- Detect a PC wired directly to the Pager and capture + summarize its traffic. -
LanScan.sh- nmap-based LAN scanner over the Ethernet/USB-C interface. -
pcap.sh- Start/stop the Pineapple's own optimized WiFi packet capture. -
usb_monitor.sh- Background daemon that notifies on USB-C/USB-A attach and detach.
LAN packet sniffer, with a bridge/tap mode for a two-NIC PC-through-Pager setup.
sniff.sh - LAN packet sniffer. Wraps the standard tcpdump (not Hak5-
specific, but pre-installed and the normal tool for this). Supports a
bridge/tap mode for a two-NIC setup: PC -> Pager USB-C LAN -> [Pager
bridges] -> Pager USB-A (e.g. a UGREEN adapter) -> router/repeater. In
bridge mode traffic actually flows through the Pager transparently while
you can sniff it on either side - a real inline tap, not just a capture
on one interface.
Every capture is automatically summarized when it finishes (top talkers,
protocol breakdown, and a cleartext-credential scan) - you get an
immediate, readable report instead of a raw .pcap you have to download
and open in Wireshark to learn anything from.
Usage:
sniff.sh --iface eth1 [--filter "tcpdump expr"] [--duration SECONDS] [--count N]
sniff.sh --bridge IFACE1 IFACE2 [--dhcp] bridge two NICs into a transparent tap (br-sniff)
sniff.sh --unbridge tear the bridge back down
sniff.sh --list list candidate wired interfaces
sniff.sh --adapters check USB-C + USB-A wired adapter status
sniff.sh --summary FILE re-run the summary/creds scan on a saved capture
sniff.sh --status is a capture currently running?
sniff.sh --stop stop a background capture
sniff.sh interactive mode
Options:
--iface IFACE Interface to capture on (default: eth1, or br-sniff if bridged)
--filter EXPR Raw tcpdump filter expression, e.g. "port 80 or port 443"
--duration SECONDS Stop after this many seconds (default: capture until Ctrl+C)
--count N Stop after N packets
--quiet Don't print packets live - just save silently (old default
behavior; live output is now ON by default - see below).
--output FILE Save to a specific .pcap file (default: timestamped under /root/loot/sniff/)
--background Launch capture detached (still writes live packet text
into /tmp/pager-sniff.log - `tail -f` it, or --stop to end it)
--no-summary Skip the auto-summary/creds scan after capture
--dhcp With --bridge: also request a real DHCP lease on the
bridge device from the LAN being tapped, so the
Pager stays reachable by SSH there too - no reset
needed after a normal bridge/unbridge cycle.
-y, --yes Don't prompt for confirmation
-h, --help This help
BUG FOUND AND FIXED: live packet output used to be OFF by default (needed
an explicit --live flag) - a plain `sniff.sh --iface eth0 --duration 30`
ran completely silently for the whole duration, which looked exactly like
a hang ("it just says it launches with 30 seconds" and nothing else,
reported live against this exact device). Live output is now ON by
default in every mode (foreground AND --background, which now also
writes real packet text into its log instead of nothing) - pass --quiet
for the old silent behavior. Cleartext-credential hits in the auto-
summary are now shown in RED (see summarize_pcap) so they're impossible
to miss in a scroll of otherwise-plain traffic.
Two-adapter tap topology: the Pager has exactly two wired LAN paths - the
built-in USB-C port (always eth0, a Realtek RTL8153 USB-Ethernet gadget
per Hak5's own docs - this is also the port used for SSH/management) and
whatever USB Ethernet adapter (e.g. a UGREEN one) is plugged into the
USB-A port. Every run of this script checks and prints which of the two
is physically connected right now (by sysfs device path, not guesswork)
automatically, before capturing - no separate step to remember. `--adapters`
still exists as a quick check-only shortcut if you just want the status.
Live, continuously-scrolling packet trace (watch traffic as it happens).
tracer.sh - Live, continuously-scrolling packet trace ("wireshark-like" -
you watch traffic go by AS IT HAPPENS, not capture-then-review). Wraps
the standard tcpdump (not Hak5-specific, but pre-installed) in line-
buffered live mode. Different tool than sniff.sh on purpose: sniff.sh's
whole design is capture-to-a-file-then-summarize; this is the opposite -
nothing saved by default, just a live firehose to the screen, for "what
is going on right now" instead of "what happened, tell me after".
Three trace targets:
--wifi Your OWN WiFi connection's traffic (the wlan0cli client
interface - present only once actually associated to a
network via WIFI_CONNECT/wifi.sh). Requires being
connected - if you're not, this errors clearly instead of
silently doing nothing or capturing nothing useful.
--lan Wired LAN traffic (USB-A external adapter by default, same
as sniff.sh - eth0 is the USB-C management/SSH link, so
tracing it live mostly just shows your own SSH session).
--monitor Passive 802.11 monitoring (wlan1mon/wlan0mon) - sees
nearby WiFi frames over the air, same interfaces recon
uses. Does NOT require being connected to anything (this
is literally what recon watches to build its device
list) - it's the one mode where "not connected" is not
an error condition.
Usage:
tracer.sh --wifi [--filter EXPR]
tracer.sh --lan [--iface IFACE] [--filter EXPR]
tracer.sh --monitor [--iface wlan0mon|wlan1mon]
tracer.sh --background (with one of the above) trace detached to a log
tracer.sh --status
tracer.sh --stop
tracer.sh interactive mode
Options:
--wifi Trace this device's own WiFi client connection
--lan Trace wired LAN traffic
--monitor Passively watch nearby 802.11 traffic (no connection needed)
--iface IFACE Interface override (--lan/--monitor only)
--filter EXPR Raw tcpdump/BPF filter, e.g. "port 80 or port 443"
--save FILE Also write a .pcap alongside the live view (default: not saved)
--background Trace detached - use --status/--stop to manage it
--status Is a background trace currently running?
--stop Stop a background trace
-h, --help This help
Not connected / no target and asked for --wifi -> clear error, exits
non-zero, no silent no-op. Same honesty as the rest of this toolkit: a
tool that "succeeds" while doing nothing is worse than one that says so.
Detect a PC wired directly to the Pager and capture + summarize its traffic.
pc_link.sh - The moment a PC is wired directly to the Pager, capture and
summarize its traffic - not a one-shot port scan (that told you almost
nothing useful about a machine that's just sitting there being your own
PC). This finds whichever of the two point-to-point PC links is active
and hands off to sniff.sh's existing capture+summary pipeline (top
talkers, protocol breakdown, cleartext-credential scan) on that exact
interface, so you get a real look at what's actually crossing the wire.
The two PC links:
- USB-C (eth0, built-in): per Hak5's docs this is a Realtek RTL8153
USB-Ethernet gadget straight to a host PC/laptop, bridged into
br-lan (172.16.52.0/24) where the Pager itself is the DHCP server -
a tethered PC shows up in the Pager's own DHCP lease file.
- USB-A (eth1, external adapter e.g. UGREEN): configured as a DHCP
CLIENT on this device (confirmed via `uci show network`), so
whatever's on the other end - a PC doing internet connection
sharing, or a router - is found via the interface's gateway/
neighbor instead.
Usage:
pc_link.sh --detect show what's connected on each wired PC-link path
pc_link.sh --capture [--duration SECONDS] detect + capture/summarize that link's traffic
pc_link.sh --capture --iface IFACE capture a specific interface instead of auto-detecting
pc_link.sh interactive mode
Options:
--detect Just report what's on each link, don't capture.
--capture Detect (or use --iface) and capture+summarize traffic.
--iface IFACE Capture this interface instead of auto-detecting.
--duration SECONDS How long to capture (default: 30).
--background Capture detached - see sniff.sh --stop/--status.
-y, --yes Don't prompt for confirmation.
-h, --help This help.
nmap-based LAN scanner over the Ethernet/USB-C interface.
LanScan.sh - LAN scanner for the WiFi Pineapple Pager's Ethernet/USB-C
interface (eth1), using the pre-installed nmap.
The Pager has no dedicated "LAN scan" Pineapple command - this wraps the
standard, already-installed `nmap` (see External Packages docs) against
whatever subnet eth1 is on, once you've plugged a USB-C-to-Ethernet
adapter into the Pager and the other end into a router/switch.
Usage:
LanScan.sh interactive mode
LanScan.sh --mode quick [options]
LanScan.sh --list
Options:
--iface IFACE Interface to scan from (default: eth1)
--subnet CIDR Target subnet, e.g. 192.168.1.0/24 (default: auto-detect from iface)
--mode MODE ping | quick | full | service | vuln | custom (default: quick)
--ports SPEC Port spec for --mode custom, e.g. 22,80,443 or 1-1000
--extra-args "ARGS" Extra raw nmap arguments (advanced)
--output FILE Save results to a specific file (default: timestamped under /root/loot/lanscan/)
--list List past scans in /root/loot/lanscan/ (newest first) and exit - no scan run
-y, --yes Don't prompt for confirmation
-h, --help This help
Modes:
ping - nmap -sn host discovery only, fastest
quick - nmap -T4 -F top 100 ports on live hosts
full - nmap -T4 -p- all 65535 ports
service - nmap -sV -T4 service/version detection
vuln - nmap --script vuln NSE vulnerability scripts (if available)
custom - nmap with --ports / --extra-args as given
Start/stop the Pineapple's own optimized WiFi packet capture.
pcap.sh - Start/stop the Pineapple's optimized WiFi packet capture.
Wraps WIFI_PCAP_START / WIFI_PCAP_STOP.
Usage:
pcap.sh --on start capture
pcap.sh --off stop capture
pcap.sh --list list captured pcap files
pcap.sh interactive mode
Background daemon that notifies on USB-C/USB-A attach and detach.
usb_monitor.sh - Notifies every time a device attaches or detaches on
USB-C (eth0, the built-in port) or USB-A (whatever's plugged into the
external port). Not a payload on purpose - this is a plain background
watcher, not something meant to be started/stopped or configured
through a picker.
BUG FOUND AND FIXED (reported live - tested with a real Netgear A8000
USB WiFi adapter, no message ever appeared): the ORIGINAL USB-A
detection only used detect_usb_a_iface() (lib/common.sh), which finds
USB ETHERNET adapters specifically - correct for pc_link.sh's actual
job (wired LAN capture), but it deliberately skips anything wlan*-
prefixed, and a USB WiFi adapter never creates an ethN interface at
all - it's invisible to that check by design, not by bug. Confirmed
live via dmesg: the A8000 is an mt7921u device (the SAME chipset family
as the Pager's own internal radio) - it enumerated on the USB bus fine,
just never as a network interface detect_usb_a_iface() would recognize.
Fixed by adding a SECOND, lower-level detector alongside the existing
one: real USB bus attach/disconnect events straight from dmesg, which
catches ANY peripheral (WiFi adapter, Ethernet adapter, storage,
anything) regardless of whether it ever gets a driver/interface at all.
The one thing that needs excluding: the Pager's OWN internal WiFi radio
is *also* a USB device internally (confirmed live: also an mt7921u,
identified via `product` = "Wireless_Device" at a FIXED bus path) - if
its driver ever reinitializes, that would look identical to an external
device being plugged in without this exclusion. get_internal_radio_usb_path
below finds that path dynamically at startup (not hardcoded - the exact
path can differ between individual units/firmware), so it can be told
apart from a genuinely external USB-A device every time.
Detects three distinct things now:
- USB-C (eth0) is a fixed platform device that always exists - only
its CARRIER (cable plugged in / link up) can change.
- USB-A Ethernet adapters: interface-level detail (which ethN to use)
via detect_usb_a_iface(), same as before - still useful when it IS
an Ethernet adapter, since it tells you the interface name.
- USB-A ANY device: real USB bus attach/disconnect events via dmesg,
catching non-Ethernet peripherals too (like the A8000).
Reuses iface_has_carrier/detect_usb_a_iface from lib/common.sh for the
Ethernet-specific case - no new mechanism there, same helpers pc_link.sh
/sniff.sh already trust.
Usage:
usb_monitor.sh --watch foreground, prints on every change, Ctrl+C to stop
usb_monitor.sh --background same, detached - use --stop to end it
usb_monitor.sh --status is it running?
usb_monitor.sh --stop stop a background run
Options:
--watch Run in the foreground.
--background Run detached; use --stop to end it.
--status Is a background watcher currently running?
--stop Stop a background watcher.
-h, --help This help.