Hi, For my thesis, i'm trying to write a bluez based honeypot. The basic concept is to listen at the hci level and perform actions. (switch on sockets in rfcomm or l2cap channels or addresses to audit the data) I started studying the hcidump code and the hci socket. The main problem i'm having is that the hci socket which is created in this way sk = socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI); does not "pop" the package from the bluez stack, it just reads but the package will continue to be processed by the stack. So if there is an attempt for a connection it will find a closed socket. Is there a way to "pop" the package from the stack, so i can read the destination channel or address of the package and turn on a socket on that specified channel or address and then "push" again the package into the stack? If it's not possible, the only way to set my bluetooth honeypot up is to open a socket for each rfcomm and l2cap channel and address and wait for data to audit. Thanks. -- Vincenzo Ampolo http://goshawknest.wordpress.com/ http://vincenzo-ampolo.net GnuPG Key: http://keyserver.ubuntu.com:11371/pks/lookup?op=get&search=0x9BF47CA71E506DE9
Attachment:
signature.asc
Description: This is a digitally signed message part.
