0

I'm trying to sniff out my network's wireless traffic but am having issues. I'm able to put the card in monitor mode, but am unable to see any traffic except broadcasts, multicasts and probe/beacon frames.

I have two network interfaces on this laptop. One is connected normally to 'linksys' and the other is in monitor mode. The interface in monitor mode is on the right channel. I'm not associated with the access point because, as I understand, I don't need to if using monitor mode (vs promiscuous). When I try to ping the router ip, I'm not seeing that traffic show up in wireshark.

Here's my ifconfig settings:

daniel@seasonBlack:~$ ifconfig
eth0      Link encap:Ethernet  HWaddr 00:1f:29:9e:b2:89  
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
          Interrupt:16 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:112 errors:0 dropped:0 overruns:0 frame:0
          TX packets:112 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:8518 (8.5 KB)  TX bytes:8518 (8.5 KB)

wlan0     Link encap:Ethernet  HWaddr 00:21:00:34:f7:f4  
          inet addr:192.168.1.116  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::221:ff:fe34:f7f4/64 Scope:Link
          UP BROADCAST RUNNING  MTU:1500  Metric:1
          RX packets:9758 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4869 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:3291516 (3.2 MB)  TX bytes:677386 (677.3 KB)

wlan1     Link encap:UNSPEC  HWaddr 00-02-72-7B-92-53-33-34-00-00-00-00-00-00-00-00  
          UP BROADCAST NOTRAILERS PROMISC ALLMULTI  MTU:1500  Metric:1
          RX packets:112754 errors:0 dropped:0 overruns:0 frame:0
          TX packets:101 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:18569124 (18.5 MB)  TX bytes:12874 (12.8 KB)

wmaster0  Link encap:UNSPEC  HWaddr 00-21-00-34-F7-F4-00-00-00-00-00-00-00-00-00-00  
          UP RUNNING  MTU:0  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

wmaster1  Link encap:UNSPEC  HWaddr 00-02-72-7B-92-53-00-00-00-00-00-00-00-00-00-00  
          UP RUNNING  MTU:0  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

Here's my iwconfig settings:

daniel@seasonBlack:~$ iwconfig
lo        no wireless extensions.

eth0      no wireless extensions.

wmaster0  no wireless extensions.

wlan0     IEEE 802.11bg  ESSID:"linksys"  
          Mode:Managed  Frequency:2.437 GHz  Access Point: 00:18:F8:D6:17:34   
          Bit Rate=54 Mb/s   Tx-Power=27 dBm   
          Retry  long limit:7   RTS thr:off   Fragment thr:off
          Power Management:off
          Link Quality=68/70  Signal level=-42 dBm  Noise level=-69 dBm
          Rx invalid nwid:0  Rx invalid crypt:0  Rx invalid frag:0
          Tx excessive retries:0  Invalid misc:0   Missed beacon:0

wmaster1  no wireless extensions.

wlan1     IEEE 802.11bg  Mode:Monitor  Frequency:2.437 GHz  Tx-Power=27 dBm   
          Retry  long limit:7   RTS thr:off   Fragment thr:off
          Power Management:off
          Link Quality:0  Signal level:0  Noise level:0
          Rx invalid nwid:0  Rx invalid crypt:0  Rx invalid frag:0
          Tx excessive retries:0  Invalid misc:0   Missed beacon:0

Here's how I know I'm on the right channel:

daniel@seasonBlack:~$ iwlist channel
lo        no frequency information.

eth0      no frequency information.

wmaster0  no frequency information.

wlan0     11 channels in total; available frequencies :
          Channel 01 : 2.412 GHz
          Channel 02 : 2.417 GHz
          Channel 03 : 2.422 GHz
          Channel 04 : 2.427 GHz
          Channel 05 : 2.432 GHz
          Channel 06 : 2.437 GHz
          Channel 07 : 2.442 GHz
          Channel 08 : 2.447 GHz
          Channel 09 : 2.452 GHz
          Channel 10 : 2.457 GHz
          Channel 11 : 2.462 GHz
          Current Frequency=2.437 GHz (Channel 6)

wmaster1  no frequency information.

wlan1     11 channels in total; available frequencies :
          Channel 01 : 2.412 GHz
          Channel 02 : 2.417 GHz
          Channel 03 : 2.422 GHz
          Channel 04 : 2.427 GHz
          Channel 05 : 2.432 GHz
          Channel 06 : 2.437 GHz
          Channel 07 : 2.442 GHz
          Channel 08 : 2.447 GHz
          Channel 09 : 2.452 GHz
          Channel 10 : 2.457 GHz
          Channel 11 : 2.462 GHz
          Current Frequency=2.437 GHz (Channel 6)
3
  • It looks like you have it set up properly. There may be some driver-specific considerations. Have a look at wiki.wireshark.org/CaptureSetup/WLAN or try using kismet which may be easier than manually trying to configure the wireless card. Jan 5, 2011 at 0:24
  • You have wireshark running, and you ping from the system with wireshark on it, and you can't see the ICMP packets?
    – Zoredache
    Jan 5, 2011 at 1:53
  • Yes, I ping from the system with wireshark on it. The ping is going outbound through the wlan0 interface. I have wireshark monitoring the wlan1 interface, yet I don't see any ICMP packets.
    – sybind
    Jan 5, 2011 at 2:38

2 Answers 2

1

Alright, I figured it out. It was my network adapter on wlan1. It must be something with the chipset or driver.

What I did was enable monitor mode on wlan0 and connected normally with wlan1. After that, I configured wireshark to monitor traffic on the wlan0 interface. I could see all of the traffic after that.

0

Someone correct me if I'm wrong, but the reason being would be because you are only sniffing traffic coming to your machine. In order to see all traffic on a subnet, you'll have to either span ports on a switch or poison the ARP cache of a switch.

2
  • 1
    This is a wireless network, not a switched network. All traffic is broadcast through the air. By setting the wireless interface to monitor mode, I can see all of the traffic.
    – sybind
    Jan 5, 2011 at 2:36
  • I'm pinging the gateway ip of the router wlan0 is attached to. I should see this, right? Is there anything I can do, to test it further? I was thinking of constructing a broadcast packet somehow and sending it out wlan0, just to make sure I can see something.
    – sybind
    Jan 6, 2011 at 0:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .