I detect a lot of packages on 'wlan0' on my laptop. They all look like this:
The source address belongs to the router, the destination address belongs to a wifi radio which is connected to the wlan. I guess there is nothing wrong with these packages, since the radio is playing a web radio station. But why do I detect them on the wlan0 device of my laptop? I have no intention in any communication between my laptop and the wifi radio.
asked 14 Mar '16, 16:36
You are capturing the WiFi traffic in promiscuous mode. The WiFi interface will only capture packets of the currently joined 802.11 network (with a specific SSID and channel).
For a more detailed explanation, refer to the Wireshark wiki on capturing WiFi:
answered 15 Mar '16, 04:33
Promiscuous mode behaviour on wireless interfaces largely depends on the hardware and drivers. So let's start from the start and see how the radio frame passes through the layers of processing.
So in another words: it is unlikely that the wlan0 is in promiscuous mode when you do not capture. Try to capture with promiscuous mode off and see whether the packets are still there or not. How to capture without promiscuous mode depends on what software you use (GUI Wireshark or any of the three: dumpcap, tshark, or tcpdump). In GUI Wireshark 2.0.x, you have to untick the "promiscuous mode on all interfaces" checkbox and set promiscuous mode on wlan0 to
So the summary is that your laptop's hardware always receives the frames if you use the same wireless channel like the WiFi radio receiver. The difference is how far they get in the hardware and network stack. If you only see them in a capture taken in promiscuous mode, the only thing you could do to save your laptop from receiving them would be to use a different radio channel for the WiFi network for the laptop and the WiFi network for the radio receiver. But without promiscuous mode, they do not bother the network stack and waste the CPU and memory.
answered 15 Mar '16, 07:33