This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

hello! Recently, I try to capture packets with tshark. I execute airmon-ng start wlan0 to set my wireless network card to monitor mode, and then excute tshark -i mon0 -Tfields -e frame.time_relative -e frame.len -e radiotap.datarate -e radiotap.dbm_antsignal -e ip.src -e ip.dst -Eseparator=# >channel_6.txt -a duration:10& , but ip.src and ip.dst don't display anything. I try using -V, and find that IP was not been parsed. If I don't set my wireless network card, radiotap don't display anything, but can get the ip.src. Please help me and sorry for my poor English! Thanks again!

asked 25 Sep '13, 09:16

btk913's gravatar image

btk913
1112
accept rate: 0%

edited 25 Sep '13, 09:49

grahamb's gravatar image

grahamb ♦
19.8k330206


monitor mode ... ip.src and ip.dst don't display anything

If your network is "protected", meaning it's using WEP or WPA/WPA2, the traffic on it is encrypted and, if you capture in monitor mode, the packets you get will not have been decrypted. You will have to configure TShark to decrypt it; see the Wireshark Wiki "how to decrypt 802.11" page. If you configure Wireshark, you've also configured TShark, as the configuration information is used by both of them. You could also configure that information by editing the Wireshark preferences file, but that's a more complicated process. Other parts of that, such as the requirement to capture the initial EAPOL handshake, also apply, so you may need to disconnect machines from the network and then reconnect them, or put them to sleep and wake them up, to force the handshake to occur. This even applies to the machine running TShark if you want to capture and decrypt its traffic.

permanent link

answered 25 Sep '13, 16:40

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%

This is my first time that get right answer from forum. Thank you so much. I will try this tonight. Thanks again!

(25 Sep '13, 18:29) btk913
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×832
×549
×76

question asked: 25 Sep '13, 09:16

question was seen: 2,487 times

last updated: 25 Sep '13, 18:29

p​o​w​e​r​e​d by O​S​Q​A