This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

As the title says, i can capture only broadcast packages while capturing on wlan. That's what i did: sudo airmon-ng start wlan0 , airmon check kill (to kill the process that causes trouble), airmon-ng stop wlan0mon , airmon-ng start wlan0 , and the network adapter succesfully enter in monitor mode. then i sudo wireshark , and start capturing on wlan0mon . But the only thing i can see is a lot of broadcast packages, and some other packages that i don't really care about. Actually i need to capture packages sent and received from my phone, connected by WiFi. What am i doing wrong? [ I tried with ARPspoof, but the phone loses connection (i can see only the DNS requests it send to the rounter. i can't connect e.g. to google.com). ]

asked 27 Mar '16, 03:12

Hikami's gravatar image

Hikami
6112
accept rate: 0%

Several possibilities:

  • you may be monitoring at a different frequency channel than your WLAN is using

  • your phone may use a more advanced modulation than your PC's wireless NIC is able to demodulate

  • you may be using WPA encryption on your network so those frames you "don't care about" may actually be the ones you're interested in but do not look like that due to encryption

  • your phone may be too far or too close from the monitoring wireless card, causing the signal to be too noisy to be demodulated (too weak signal if too far as well as too strong one if too close may both prevent the receiver from working properly).

If you believe you are monitoring at the proper frequency channel, and your phone is about 2 meters / 7 ft away from your PC while capturing and you still cannot see anything useful, try to publish the resulting capture at cloudshark or at some login-free file sharing service (Google drive, MS OneDrive) and edit your question with a link to it.

(28 Mar '16, 13:44) sindy

Can you try to do the following?

  1. Determine the Channel frequency, Channel bandwidth and Center 1 frequency. This can be done by connecting the WLAN adapter that will be used for the capture to the same SSID that is of interest. Then issue the command "wlan0 info".
  2. Disassociate the WLAN adapter from the SSID.
  3. Issue the commands:

    ifconfig wlan0 down

    iw dev wlan0 set type monitor

    ifconfig wlan0 up

    iw dev wlan1 set freq 5180 40 5190

  4. Launch Wireshark

  5. Select the mon0 interface
permanent link

answered 28 Mar '16, 13:28

Amato_C's gravatar image

Amato_C
1.1k142032
accept rate: 14%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×549
×76
×31
×5

question asked: 27 Mar '16, 03:12

question was seen: 2,169 times

last updated: 28 Mar '16, 13:44

p​o​w​e​r​e​d by O​S​Q​A