Bluetooth honeypot - hci socket that reads package problem -

[Vincenzo Ampolo <vincenzo.ampolo@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 1206 bytes --]

Hi,

For my thesis, i'm trying to write a bluez based honeypot.
The basic concept is to listen at the hci level and perform actions. (switch 
on sockets in rfcomm or l2cap channels or addresses to audit the data)

I started studying the hcidump code and the hci socket. The main problem i'm 
having is that the hci socket which is created in this way

	sk = socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI);

does not "pop" the package from the bluez stack, it just reads but the package 
will continue to be processed by the stack. So if there is an attempt for a 
connection it will find a closed socket. Is there a way to "pop" the package 
from the stack, so i can read the destination channel or address of the 
package and turn on a socket on that specified channel or address and then 
"push" again the package into the stack?

If it's not possible, the only way to set my bluetooth honeypot up is to open 
a socket for each rfcomm and l2cap channel and address and wait for data to 
audit.

Thanks.  
-- 
Vincenzo Ampolo
http://goshawknest.wordpress.com/
http://vincenzo-ampolo.net

GnuPG Key: 
http://keyserver.ubuntu.com:11371/pks/lookup?op=get&search=0x9BF47CA71E506DE9

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 197 bytes --]