This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I would like to capture the traffic of one wireless device on my wireless network. I have placed a switch between the Wireless router and my DSL modem and am port forwarding traffic to a laptop. When I capture traffic all I see is the IP address of the Wireless router. Is there a way to capture just the traffic of the one wireless device?

asked 14 May '13, 06:28

Tanuki's gravatar image

Tanuki
1111
accept rate: 0%


Looks like you're capturing the packets after they have been through the Network Address Translation (NAT) process. In that process the internal IPs are replaced with your public IP. Unfortunately you cannot capture the internal IP addresses on the outside of a NAT gateway. The only workaround is to dump the NAT table to see what external connection represents what internal connection, but not all devices support this, and it is tedious work.

It may be easier to try and capture the WiFi traffic directly, but that is a bit more complicated. On Windows you'd need an AirPCAP adapter, while on Linux etc. you need to enable monitor mode manually before running Wireshark.

permanent link

answered 14 May '13, 06:41

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

while on Linux etc. you need to enable monitor mode manually before running Wireshark.

...and while on OS X you need to check the monitor mode checkbox (that doesn't currently work on most Linux systems, for various reasons; it may work on some *BSD systems, but not all).

(15 May '13, 12:30) Guy Harris ♦♦

Note also that on a "protected" network (i.e., a network using WEP or WPA/WPA2, on which the traffic is encrypted), you will have to arrange that the traffic can be decrypted.

(15 May '13, 12:33) Guy Harris ♦♦

As @Jasper said, your wireless router is doing NAT. If your DSL modem is also doing NAT, then you could decide to configure your wireless router to work in bridging mode. That way, the traffic from the wireless clients will no longer be translated and you can use the current capture setup to monitor a specific client.

permanent link

answered 14 May '13, 07:00

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%

Thank you both for your help. I will try putting the router in bridge mode tonight and report back tomorrow.

(14 May '13, 09:33) Tanuki
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×139

question asked: 14 May '13, 06:28

question was seen: 5,223 times

last updated: 15 May '13, 12:33

p​o​w​e​r​e​d by O​S​Q​A