Hi I need to sniff WiFi packets, can anyone tell what is the difference between using Monitor mode and Aircrack-ng in linux and using the Airpcap in windows? there is any kind of data that can be extracted from one method but not from the other? what is the better way to sniff WiFi packets? Thanks! asked 13 Oct '15, 08:08  MichaelB edited 13 Oct '15, 16:04  Guy Harris ♦♦ |
2 Answers:
IMHO, go with the Linux solution and stay away from AirPCAP! Reasons:
a. Lack of 11ac support b. I cannot find any documentation in which AirPCAP supports LDPC coding. Unfortunately, all the new 11n and all the 11ac adapters support LDPC. If your WiFi capturing adapter does not support LDPC, then you cannot capture data packets between the AP/wireless router and the WiFi client. I have asked a similar question on other communities (my question was related to the preferred WiFi capturing tool/software) and all the WiFi developers came back with the same answer: use Linux and get a WiFi card that supports the features you need. answered 13 Oct '15, 18:20  Amato_C |
I'd say not much. In both cases you will see WLAN/Wifi frames of other stations, besides your own frames. The main reason why you need Airpcap on Windows, is because you can't (easily) put a wlan/wifi card in monitor mode on Windows, at least not with WinPcap.
Airpcap will probably report signal strength and similar HW related values, which your wifi card on Linux might or might not report (depends on the card and the driver).
Better in terms of what? Both methods will deliver wlan/wifi frames. I don't see a way to do that 'better'. Regards answered 13 Oct '15, 13:52  Kurt Knochner ♦ |
UPDATE: The AirPcap Nx WiFi adapter uses the the AR9170 WiFi chipset from Qualcomm-Atheros. The AR9170 chipset does not support LDPC coding which means that the AirPcap Nx adapter also does not support LDPC coding.
If the WLAN being monitored (Access Point and client) uses LDPC coding, then the WiFi adapter used for capturing WiFi frames must also support LDPC coding too. Otherwise, packets sent at HT or VHT rates in one or both directions will be missing or damaged. Since LDPC coding occurs at the hardware level, a firmware upgrade cannot provide LDPC coding to the WiFi adapter.