2

I'm using Wireshark on OSX, trying to sniff my home network over WiFi. While I can see packets that are sent to/from the host I'm sniffing on, I'm not seeing anything else that goes over the WiFi. It's like I'm not in promiscuous mode or something (the promiscuous mode box is in fact checked).

The router is an Apple Airport Extreme, protected by WPA2. I'm attached to the network I'm trying to sniff, so I'm confused about why I can't see other traffic.

Edit: I solved this by the following:

  1. Plug Macbook directly into the Airport Extreme router
  2. Enable "internet sharing" on Macbook, with no password.
  3. Bind wireless device (the one I wanted to sniff) to the WiFi hotspot generated by Internet sharing in step 2.
  4. Run Wireshark on the Macbook, bound to device en1.

Don't forget to disable sharing after you're done. :-)

1
  • Check to see if your wireless card allows you to enter 'monitor mode'. Most of the wireless cards in MacBooks and MacBook Pros won't let you do this.
    – Scott Pack
    Mar 19, 2011 at 12:12

2 Answers 2

4

Probably because it's acting like a switch. You might need to set it to bridged mode and plug it into a switch with a SPAN port or consider a network tap.

See last paragraph.

4
  • Actually that's what I started with- a host physically plugged into the router, and I was getting the same result. Mar 19, 2011 at 1:36
  • 1
    @Caffeine Same issue; you aren't getting packets that aren't bound for your MAC address. Without ARP poisoning, you aren't going to receive those packets on a switched network. As @Astron said, you'll need to get those packets coming to your system before your promisc mode adapter will be able to see them. Options are mirror/SPAN ports, getting between the devices with bridging, or a good old-fashioned hub. Mar 19, 2011 at 1:46
  • I expected to not see the packets when physically wired, since it's a switch, but was surprised that WiFi was unable to see them (I expected it to work like a physical tap on the same network segment). Should I expect to see packets if I turn off WPA? Mar 19, 2011 at 2:44
  • 1
    @Caffeine: I do not think so but could vary due to the model or using a third-party firmware. Think about how inefficient an access point would be if it flooded traffic to all clients like a hub does. The links would probably saturate quickly.
    – Astron
    Mar 19, 2011 at 2:49
0

Most commodity WiFi+router devices are also cheap switches without management ports, and you need more than just promiscuous mode to decode the WPA2 session secrets of the packets for computers other than your own. (And KisMac is long dead. iStumbler doesn't seem to be quite as capable IME, and even so WPA2 is a stretch.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .