This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

AIRPCAP and URL Viewing

0

Hi, I am pretty new to all of this, so not sure if what I am trying to do is possible. My end goal is to see the URLs visited from each computer/phone that hits my WiFi at home. I have used OpenDNS which is fine for the domain name, but I want more detail.

I downloaded wireshark and tested it out. I was able to successfully see every URL the computer hit over the capture period. Now I want to see that same info on other devices. I am running Windows. From reading here, it looks like I need to buy AIRPCAP in order to do this. However, I haven't been able to find a straight answer on whether it will get the URLs.

Can someone please provide a straight answer to the following?

If I purchase AIRPCAP and run it with wireshark, will I be able to see every URL that other devices on my WiFi hit? In particular, there is only 1 device I am most concerned with, so I can filter the capture to only hit that one device. I just really want to know whether I will be able to see the full URL.

When I was capturing on my computer, I was able to see the full link, and could click on it to go to the exact page that the computer was on. That is what I want to be able to do for other devices (really just 1 in particular.)

asked 12 Oct '15, 03:44

questions123's gravatar image

questions123
6223
accept rate: 0%

What's the status on WiFi encryption?

What's happening when HTTPS access is used?

(12 Oct '15, 04:02) Jaap ♦

One Answer:

0

The answer to your question is YES - if you capture the WiFi frames, you will be able to view the URL.

Now, as @Jaap has eluded to, there are many assumptions that are made here:

  1. Can the AIRPCAP device properly capture the WiFi frames on your network? For example, AIRPCAP only supports 11n and if your network supports 11ac, then you might not be able to capture the data frames - which contains the information you are looking for.
  2. Have you properly captured the EAP exchange between device and the AP? If not, you will not be able to decrypt the data and see the URL.

So yes, AIRPCAP can work. But it is an expensive solution ($700 for a WiFi adapter!!!). There are other cheaper and IMHO better ways than using AIRPCAP to capture WiFi frames.

answered 12 Oct '15, 10:51

Amato_C's gravatar image

Amato_C
1.1k142032
accept rate: 14%