Hi I have 2 USB adapters - 802.11ac enabled, it supports monitor mode operation. I have wireshark version 1.10. I enable one of the USB adapters in monitor mode and connect the other adapter to 802.11ac AP. I want to capture the traffic generated between AP and client (802.11ac). However, the monitor mode interface is capture nothing at all. Please guide me where am I wrong. Thanks. asked 04 Nov '15, 04:12  dheryta showing 5 of 11 show 6 more comments |
One Answer:
Try this: In all these commands, my WiFi adapter was named wlan1 in Ubuntu.
For example: iw deb wlan1 set freq 5180 80 5210 answered 05 Nov '15, 11:13  Amato_C |
What OS do you use?
I am using Ubuntu 14.04
Are both USB adapters connected to the same PC/laptop?
"Capturing nothing" meaning "you try to capture and there are no packets at all" or "capturing nothing" as in "just a whole bunch of packets identified as '802.11' but nothing that looks like regular network traffic"?
@Amato_C: no both adapters are connected to different laptops, connected to same AP in infrastructure mode.
@Guy Harris: Its the former one, 'no packets at all'. The adapter is Edimax AC1200 and it supports monitor mode operation.
In the question, you say " I enable one of the USB adapters in monitor mode and connect the other adapter to 802.11ac AP." In a comment, you say "no both adapters are connected to different laptops, connected to same AP in infrastructure mode." Are both adapters connected to the AP, or is only one of them connected?
@Guy Harris: Sorry, that was an error. One of the adapters is connected to AP in infrastructure mode and the other is enabled as a monitor mode interface (not associated to AP) to capture WiFi traffic between AP and Client.
And they're both set to the same channel?
As per my understanding, in monitor mode an interface listens to all channels in round-robin fashion, so no need to set a particular channel. I have done this with Atheros card to capture WiFi traffic in 2.4GHz. Thus, I did not set any channel for monitor mode interface as well.
Not necessarily. That might be done by some adapters in some modes, but it's not done by all adapters in all modes - if channel scanning is being done, some traffic might be missed, as you won't be listening on any particular channel all the time, so it's not what you always want to do in monitor mode.
It's not done in software by Wireshark.
I added monitor mode interface in Linux with following command sudo iw dev wlan1 interface add mon1 type monitor sudo ifconfig mon1 up
Then, I try to listen on mon1 with Wireshark.