I've been trying to analyze some equipment in an audio system. I've run wireshark on my mac while connected to a couple of different devices. Our consoles interface allows me to choose which ports are utilized for the traffic. When I start to capture packets from the network while connected to a wireless access point I'm unable to see any traffic between the console and or the ipad. I've tried running in monitor mode and without the monitor mode checked. Should the computer I'm running wireshark on be connected between the access point (that the ipad connects to) and the console or can I simply connect the laptop running wireshark to the wifi network that the ipad is on? Or do I need to do more research about the way wireshark should be setup and run? Any help would be greatly appreciated! Loren asked 04 Oct '16, 13:04  lorenjz |
This is a static archive of our old Q&A Site.
Please post any new questions and answers at ask.wireshark.org.
Seems my yesterday's comment got lost in transmission.
If you have an alternative to capturing in the air, you should always prefer it. Or, from the other perspective, you should only capture in the air if you need to diagnose air interface issues or if you have no other point on the path between the device you are interested in and the rest of the world but the air interface.
So in your case, I would recommend to capture on the Ethernet interface between the access point to which the ipad is connected over the air and the other devices. If, however, the ipad talks to other devices which are also connected to the same AP over the air, bringing another AP into the setup, connecting it to the other one using wired Ethernet and connecting the ipad to one AP and the other devices to the other AP provides you much less burden to deal with than capturing in the air using monitoring mode.
If I haven't scared you enough and you decide to use the over-the-air capture anyway, monitoring mode is a must, and on a Mac, monitoring works the best of all platforms. So your issue may be encryption - if you use it, you have to capture the ipad's "login" to the WLAN.
There is a wiki page on capturing setup in general which further refers to wired and wireless setups in detail.