This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Taking 802.11n captures with Linux and USB wireless probes

0

This is my first question so please be nice.

I want to set up my first package capture kit. I need to capture packages on a 802.11n network.

This is what I'm thinking on getting:

  • Dell D630
  • Linux Distro (any flavor but possibly Fedora)
  • USB N wireless Probes
  • HUB

Here are my questions:

  • If the laptop I get does not have a 802.11n card, can I still buy a hub and USB N wireless probes and still be able to capture packages?

Thanks, Ricco

asked 03 Sep '13, 21:27

ricco1982's gravatar image

ricco1982
16114
accept rate: 0%


One Answer:

1

If the laptop I get does not have a 802.11n card, can I still buy a hub and USB N wireless probes and still be able to capture packages?

Yes, especially if you run Linux on your Laptop. There are quite some USB adapters that support monitor mode (required to capture wifi traffic of other machines).

See here:

http://wiki.wireshark.org/CaptureSetup/WLAN#Linux
http://needsec.com/kali-linux-how-to-hack-wifi-tutorial-sniffing-wifi-networks-capturing-packets-backtrack-6/
http://ask.wireshark.org/questions/14148/cannot-scan-with-my-alfa-awus036h

Regarding the Hub. You won't need that for WLAN capturing, unless it is a USB hub to extend the number of USB ports (more wlan adapters to capture from).

Regards
Kurt

answered 03 Sep '13, 23:54

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 03 Sep '13, 23:59

Regarding to the Hub: I was thinking that I would a hub if I need to take a multichannel capture? Thoughts?? so at least 3 wireless N USB adapters + HUB + Linux + wireshark = 802.11n package capture??

Aprreciate the clear answer.

(04 Sep '13, 15:37) ricco1982

if I need to take a multichannel capture? Thoughts??

O.K. if you talk about a USB hub (not a network hub), then I agree. You would need several USB adapters to capture on different channels in parallel.

(04 Sep '13, 15:40) Kurt Knochner ♦

Kurt,

you have been very helpful. I really appreciate all the help here. One last question and I promise I'll leave you alone.

Should I go safe and buy a "dual-band" Wireless-N USB Adapter or only a 2.4 or a 5 GHZ? Any recommendations or preference?

Thanks,

(04 Sep '13, 20:06) ricco1982

One last question and I promise I'll leave you alone.

I hope you will not leave us alone. This site lives from contributions of people interested in Wireshark and network troubleshooting. So, please stay around ;-)

Should I go safe and buy a "dual-band" Wireless-N USB Adapter or only a 2.4 or a 5 GHZ? Any recommendations or preference?

Well, that's hard to say and in general it is not that easy to find a USB adapter with really good Linux support. I'm not going to give an advice regarding a certain adapter. Instead I suggest to look into the forums of Aircrack-NG and Kali/BackTrack Linux. There are several threads discussing the pros and cons of several USB adapters for wireless sniffing.

(05 Sep '13, 04:40) Kurt Knochner ♦