This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Can only see a bit of iphone traffic, but can see all macbook traffic on third computer

0

0 down vote favorite

I have three devices on a wireless network. One is a linux desktop, which is running wireshark, and I am trying to use the desktop to monitor the wireless traffic on my network. The other two devices on the network are an iphone and a macbook pro.

I am able to use the desktop to monitor traffic going between the router and the macbook pro. This leads be to believe that I successfully put the wireless interface on the desktop into promiscuous mode. I am also able to see the traffic between the iphone if I make the iphone check what networks are available, but normal traffic doesn't appear at all.

I thought of a number of explanations, but none of them make sense.

a) The iphone 4s only has the ability to communicate on 802.11N wireless on 2.4 GHz, so perhaps this is why I can't see any of its traffic. This, however, doesn't make sense, because if I was only looking for 5 GHz traffic, I wouldn't expect to be able to see any traffic originating from the iphone.

b) The iphone is using the cellular network. This doesn't make sense either, since I have the iphone in airplane mode connected to the wireless network only.

c) The iphone is only using channels that I am not monitoring. This doesn't make sense either, because if channel hopping really was the problem, why would the macbook pro's traffic be visible, but none the iphone's traffic not visible? This would imply that the macbook pro channel hops, while the iphone doesn't, but that the iphone goes back to the channel I happen to be monitoring when it wants to check what networks there are.

Does anyone have any ideas as to why only certain traffic from the iphone is visible?

asked 26 Sep '13, 00:01

cmw's gravatar image

cmw
11112
accept rate: 0%