I installed the Wireshark on my MAC and tried to sniff the air for WLAN packets (802.11) I see packets that looks like a higher level than what I expected For ex. I do not see Beacons or do not see Association packets when I closed and opened my WiFi. On the other hand, I do see DNS packets and NBNC packets.
Is there anything I need to configure to have this ability?
asked 29 Jan '13, 03:14
edited 29 Jan '13, 17:00
Guy Harris ♦♦
I think I found the way! :) When double clicking on the interface to use (in my case - e?1) - I chose Display in Monitor Mode (or something like that) Then I choose to use 802.11 on the item that used to be gray.
and that's it - I now see WLAN packets!
(Wireshark removes most of the packet which is a shame but... that is still something) :)
answered 29 Jan '13, 09:41
I think I understand what I see - for ex. - the Beacon: The Wireshark does read all the data - but it does not understand some of it. All the InfoElements sections he sees as DATA. Is there a way for him (Wireshark) to learn/know from the AP type/name the order of the data and the IEs? For ex. Cisco AP - the IE order is xyz; and TP AP the order is yzx...?
answered 30 Jan '13, 06:41