I am using Wireshark to analyse traffic on my home network, in particular examining packets sent between my Android phone and the AP of a WPA2 wireless network. To do this I have set my adapter into monitor mode, and entered the WLAN password and SSID under the 802.11 settings. Unfortunately, the only decrypted packet I seem to get from the analysis is a single DHCP ACK packet sent from the AP to the device. I've used the filter "eapol || ip" just so I can see that the EAPOL packets are received so that Wireshark can decrypt communication between the device and the AP, and see any IP datagrams sent between the two. I get the four EAPOL packets, and then straight after that the DHCP packet. But I never get anything else. I generate traffic by browsing websites, etc on my phone, but nothing comes up. I have my suspicions that the network card or driver or something may be buggy, for the following reasons:
I'm running version 1.10.6 of Wireshark on Ubuntu 14.04, using an Atheros wireless chipset (ath9k driver for the Atheros AR9565) Can anyone shed some light on this issue? Thanks in advance asked 08 Nov '15, 02:31 borophyll |
One Answer:
I had a similar problem with my ath10k drivers. After performing all the upgrades as stated above, I had no issues. answered 09 Nov '15, 06:09 Amato_C |
Thanks Amato, I will try this and let you know...