This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi,

I want to use wireshark to sniff all the packages that are sent and received in my local network. The machine running wireshark is wired and all the other devices on the network use Wifi. Every article that I read says you need to place your network adapter in monitor mode to capture traffic not meant for me, but monitor mode only applies to wireless network adapters. So how does it work when I want to capture wireless traffik to and from the router when I am connected with a cable?

Thanks

asked 09 Jul '14, 08:05

Rajiv's gravatar image

Rajiv
11112
accept rate: 0%


Does your setup look like this?

wifi device ---- thin air ----- router ---- thin air ----- wifi device
                                  |
                                  |
                               Ethernet
                                  |
                                  |
                             PC with Wireshark

If yes, then you cannot capture data of the wireless clients, as the packets will never be sent to the ethernet port of your Wireshark PC, unless they are talking to your IP address or if it is broadcast/multicast traffic. The reason is: There is an internal switch in your wireless router that works like a real switch. See the Wiki for an explanation

http://wiki.wireshark.org/CaptureSetup/Ethernet

If you need to see wireless traffic, you really need to capture the wireless traffic, which is done by enabling monitor mode of the wifi adapter. Please read the Wiki

http://wiki.wireshark.org/CaptureSetup/WLAN

Please be aware, that monitor mode on Windows does not work with Wireshark/WinPcap alone, as you'll need special hardware (AirPcap - search this site for it). Alternatively you can run Linux on your Wireshark PC, where it's usually much easier to enable monitor mode (see the Wiki).

Regards
Kurt

permanent link

answered 09 Jul '14, 08:14

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

Or run another sniffer on Windows that supports monitor mode; if you want to read those captures in Wireshark, that might still be possible (Wireshark can read captures from Microsoft Network Monitor, for example).

(09 Jul '14, 12:31) Guy Harris ♦♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×36
×33

question asked: 09 Jul '14, 08:05

question was seen: 8,796 times

last updated: 09 Jul '14, 12:31

p​o​w​e​r​e​d by O​S​Q​A