This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I have been successful in capturing wireless traffic in monitor mode using the tcpdump -ni option and even decrypt the WEP traffic, using wireshark, on my network that I was monitoring. But my router was configured to AUTO option for the channel. While capturing this mode, am able to various other traffic along with mine. How do I capture traffic from only the AP that I want to monitor and also monitor a particular channel of it?

Thanks in advance, Kartz

asked 26 Nov '13, 22:52

Kartzoft's gravatar image

Kartzoft
11337
accept rate: 0%

edited 26 Nov '13, 22:53


You could use capture filters to isolate the traffic to/from a particular AP. The example provided on the Wireshark Wi-Fi wiki page is:

wlan host 08:00:08:15:ca:fe

For more information on the capture filter syntax, refer to the pcap-filter man page.

As for monitoring a particular channel, from the Wireshark WLAN Capture Setup wiki page:

Put the card into monitor mode with the command ifconfig interface monitor. You can also set the channel to monitor by adding the argument channel channel_number to that command.

Refer to the wiki page for more details.

permanent link

answered 29 Nov '13, 08:32

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142
accept rate: 20%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×139
×97
×36
×23
×7

question asked: 26 Nov '13, 22:52

question was seen: 20,388 times

last updated: 29 Nov '13, 08:32

p​o​w​e​r​e​d by O​S​Q​A