Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top


I have no problem capturing packets on various wireless hotspots but there are a couple in my town that I just cannot understand why packets aren't being captured, other than those of my own. These are "open" networks (i.e., no WEP/WPA/etc. protection) where you obtain a username/password from the administrator, connect and then open internal page to log in using those credentials. Only then you get access to the Internet.

Here is what the traffic looks like:

Could someone please guide me in the right direction as to how to "decrypt" the traffic? If there's no encryption, why don't I see anything?


share|improve this question
Are you sure your wireless adapter both able to and is actually going into promiscuous mode? – Zoredache Nov 2 '10 at 17:22
Yes. I have no problem injecting packets, listening to other wireless clients/etc. Wireshark is capturing in promiscuous mode. Even when I boot into Window to do ARP spoofing with Cain, I can usually scan for MAC addresses. On these particular networks, thoug – MarkieL Nov 2 '10 at 19:32

These are beacon packets transmitted at regular intervals by an access point. They are not encrypted on any network, as none of the wifi metadata packets are encrypted (only data).

Therefore, you cannot decrypt them. There are no data in these packets however. Wireshark is showing you the (mostly uninteresting) metadata fields.

share|improve this answer
Exactly. These are the only packets that I am receiving unless I start doing something on the network, which is when I will only see my packets. It's like as if they have AP isolation of some sort. I can't scan for MAC addresses either (using Cain in Windows) -- nothing shows up. – MarkieL Nov 2 '10 at 17:04
As Zoredache has referenced, a wireless client will only recieve packets from the AP that it has associated with, and then only it's own packets. To see anything more than this you need a wireless adapter that supports rfmon mode. – joeqwerty Nov 2 '10 at 18:15
Joe, my adapter does support it and I am in the monitor (not managed) mode. Just like I said, I have no problem intercepting traffic from various networks, whether it is directed to me or to other clients. It's just these particular networks where you have to "log in" after you connected to them. – MarkieL Nov 2 '10 at 19:05

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.