-3

Re,

I have no problem capturing packets on various wireless hotspots but there are a couple in my town that I just cannot understand why packets aren't being captured, other than those of my own. These are "open" networks (i.e., no WEP/WPA/etc. protection) where you obtain a username/password from the administrator, connect and then open internal page to log in using those credentials. Only then you get access to the Internet.

Here is what the traffic looks like: http://img821.imageshack.us/img821/3195/snapshot2d.png

Could someone please guide me in the right direction as to how to "decrypt" the traffic? If there's no encryption, why don't I see anything?

Thanks!

2
  • 1
    Are you sure your wireless adapter both able to and is actually going into promiscuous mode? wiki.wireshark.org/CaptureSetup/WLAN#Promiscuous_mode
    – Zoredache
    Nov 2, 2010 at 17:22
  • Yes. I have no problem injecting packets, listening to other wireless clients/etc. Wireshark is capturing in promiscuous mode. Even when I boot into Window to do ARP spoofing with Cain, I can usually scan for MAC addresses. On these particular networks, thoug
    – MarkieL
    Nov 2, 2010 at 19:32

1 Answer 1

2

These are beacon packets transmitted at regular intervals by an access point. They are not encrypted on any network, as none of the wifi metadata packets are encrypted (only data).

Therefore, you cannot decrypt them. There are no data in these packets however. Wireshark is showing you the (mostly uninteresting) metadata fields.

3
  • Exactly. These are the only packets that I am receiving unless I start doing something on the network, which is when I will only see my packets. It's like as if they have AP isolation of some sort. I can't scan for MAC addresses either (using Cain in Windows) -- nothing shows up.
    – MarkieL
    Nov 2, 2010 at 17:04
  • As Zoredache has referenced, a wireless client will only recieve packets from the AP that it has associated with, and then only it's own packets. To see anything more than this you need a wireless adapter that supports rfmon mode.
    – joeqwerty
    Nov 2, 2010 at 18:15
  • Joe, my adapter does support it and I am in the monitor (not managed) mode. Just like I said, I have no problem intercepting traffic from various networks, whether it is directed to me or to other clients. It's just these particular networks where you have to "log in" after you connected to them.
    – MarkieL
    Nov 2, 2010 at 19:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .