Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm using Wireshark on OSX, trying to sniff my home network over WiFi. While I can see packets that are sent to/from the host I'm sniffing on, I'm not seeing anything else that goes over the WiFi. It's like I'm not in promiscuous mode or something (the promiscuous mode box is in fact checked).

The router is an Apple Airport Extreme, protected by WPA2. I'm attached to the network I'm trying to sniff, so I'm confused about why I can't see other traffic.

Edit: I solved this by the following:

  1. Plug Macbook directly into the Airport Extreme router
  2. Enable "internet sharing" on Macbook, with no password.
  3. Bind wireless device (the one I wanted to sniff) to the WiFi hotspot generated by Internet sharing in step 2.
  4. Run Wireshark on the Macbook, bound to device en1.

Don't forget to disable sharing after you're done. :-)

share|improve this question
    
Check to see if your wireless card allows you to enter 'monitor mode'. Most of the wireless cards in MacBooks and MacBook Pros won't let you do this. –  Scott Pack Mar 19 '11 at 12:12

2 Answers 2

up vote 4 down vote accepted

Probably because it's acting like a switch. You might need to set it to bridged mode and plug it into a switch with a SPAN port or consider a network tap.

See last paragraph.

share|improve this answer
    
Actually that's what I started with- a host physically plugged into the router, and I was getting the same result. –  Caffeine Coma Mar 19 '11 at 1:36
1  
@Caffeine Same issue; you aren't getting packets that aren't bound for your MAC address. Without ARP poisoning, you aren't going to receive those packets on a switched network. As @Astron said, you'll need to get those packets coming to your system before your promisc mode adapter will be able to see them. Options are mirror/SPAN ports, getting between the devices with bridging, or a good old-fashioned hub. –  Shane Madden Mar 19 '11 at 1:46
    
I expected to not see the packets when physically wired, since it's a switch, but was surprised that WiFi was unable to see them (I expected it to work like a physical tap on the same network segment). Should I expect to see packets if I turn off WPA? –  Caffeine Coma Mar 19 '11 at 2:44
1  
@Caffeine: I do not think so but could vary due to the model or using a third-party firmware. Think about how inefficient an access point would be if it flooded traffic to all clients like a hub does. The links would probably saturate quickly. –  Astron Mar 19 '11 at 2:49

Most commodity WiFi+router devices are also cheap switches without management ports, and you need more than just promiscuous mode to decode the WPA2 session secrets of the packets for computers other than your own. (And KisMac is long dead. iStumbler doesn't seem to be quite as capable IME, and even so WPA2 is a stretch.)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.