This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi

I'm trying to capture the 4-way handshake between my tablet in my room and my AP. Somehow, when I'm next to the tablet, I can only pickup Messages #1 and #3. Only if I move closer to the AP (with the tablet still in my room), I can pick up #1, #2 and #3. I don't know why I can never pick up #4 though.

Is there any reason why #2 (or #4 for that matter) is more sensitive to signal strength/distance from router?

I'm using a Raspberry Pi - could it be too slow for the task? I'm using a TP-Link WN-722N.

Thanks

asked 12 Aug '15, 02:36

mun's gravatar image

mun
16448
accept rate: 0%

edited 12 Aug '15, 05:30


EAPOL messages #2 and #4 are transmitted by the WiFi client - in this case the tablet. So distance from the tablet would be important. That also means being too close to the client may cause your RF receiver on the wireless adapter that you are using for the wireless capture (i.e., TP-Link WN-722N) to saturate. You might want to try the following:

  1. Reboot the machine you are using to perform the capture.
  2. Ensure there are no other processes/applications running on the capture PC prior to beginning the capture. This includes background processes like antivirus programs, etc.
  3. Try to keep a distance between the AP, tablet and sniffer around 10 feet. Best practices is not to exceed 12 feet, but not be less than 1 foot.

Good luck!

permanent link

answered 12 Aug '15, 06:47

Amato_C's gravatar image

Amato_C
1.1k142032
accept rate: 14%

Thanks for the advice. I'm doing it in a RPi, but could the processor/memory/disk speed be an issue? Is there a better adapter for the job?

(12 Aug '15, 06:49) mun

The RPi could be a limiting component. Are you using the Wireshark GUI to try to capture? If so, you might want to try a command line capture like tshark or dumpcap which are tools provided within Wireshark.

https://www.wireshark.org/docs/man-pages/tshark.html

https://www.wireshark.org/docs/man-pages/dumpcap.html

If you are running Linux, then you can also try tcpdump.

http://www.tcpdump.org/tcpdump_man.html

(12 Aug '15, 07:15) Amato_C
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×36

question asked: 12 Aug '15, 02:36

question was seen: 1,133 times

last updated: 12 Aug '15, 07:15

p​o​w​e​r​e​d by O​S​Q​A