This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Why am I not getting data packets when capturing with AirPcap?

0

I’m trying to use AirPCap (Classic) with WireShark Version 1.12.5 (v1.12.5-0-g5819e5b from master-1.12) 64 bit on Win7 64 bit with WinPCap 4.1.3 to capture packets on a 2.4GHz Wireless-G network (Channel 6) encrypted with a known WPA-PSK key.

The problem is that I’m seeing hardly any data packets (just control and management packets) even though the two devices I’m interested in are clearly exchanging lots of data. Neither device is the capture PC (a recent vintage HP laptop running on AC power.)

I’m using for following settings although I’ve tried others with no luck

  • promiscuous mode: on Packet size
  • filter: off buffer size: 2 megabytes
  • Channel 2437 [BG 6] offset 0 Capture
  • type: 802.11 + Radio Include 803.11
  • FCS in Frames: on FCS Filter: All
  • frames Decryption type: Wireshark
  • Decryption keys:
  • -- Type: WPA-PWD
  • -- Key: as appropriate for the network
  • -- SSID: as appropriate for the network

The capture was started with a Nexus 9 tablet with Wifi disabled and then it was enabled to ensure that the capture includes the EAPOL packets. Display filter: “eapol” clearly include the four EAPOL packets exchanged between device Htc_07:bc:f9 (The Nexus 9 tablet) and Netgear_bd_e8:6a (The Netgear router acting as the AP) However, filtering with “ip” shows only 3 bogus (corrupted) packets. Using filter “wlan.addr == b4:ce:f6:07:bc:f9” (the MAC address of the Nexus 9) show a bunch of IEEE 802.11 control packets and a few encrypted IP Multicast packets but they are not decrypted using the WPA key.

Using a capture filter such as “wlan host b4:ce:f6:07:bc:f9” does not help either.

What am I doing wrong?

asked 04 Jun '15, 10:43

Gengen's gravatar image

Gengen
6224
accept rate: 0%

converted 04 Jun '15, 11:05

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196

Does the capture filter "type data" work?

(04 Jun '15, 11:06) Guy Harris ♦♦

Can you put a sample capture on a network drive so I can look at the capture (such as Google Drive or Cloudshark)?

(04 Jun '15, 12:14) Amato_C