This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Only seeing 802.11 packets … nothing else

0

Under Mac Seria, latest version 2.4.2 (v2.4.2-0-gb6c63ae) install ... I am only seeing 802.11 packets from my Wi-Fi:en0 interface.

Am I doing something wrong ? I thought I'd see TCP and other type of protocol packets ...

thanks,

asked 16 Oct '17, 17:35

richiwalt's gravatar image

richiwalt
6112
accept rate: 0%


One Answer:

0

It must be set to monitor mode, so you are getting the raw 802.11 frames that are likely encrypted.

Under options, there is a check box for monitor mode for each adapter. Uncheck and see what you get. If you are around wifi networks that are unencrytped you will likely see udp and tcp traffic even in this state; otherwise you will need to decrypt. See the wireshark page on decryption to try that.

answered 16 Oct '17, 23:02

Bob%20Jones's gravatar image

Bob Jones
1.0k2515
accept rate: 21%

Wow ... this site makes sure nubs know who they are ! Looks like I need a measly 15 points to up-vote your answer Bob, and I only have 6 points here ...

Anyway ... yep ... my interface window needed to be stretched open more in order to see the MONITOR checkbox, which toggles the Wi-Fi: en0 back and forth between Ethernet and 802.11 plus radio tap header

(Now, will posting this reply be enough to earn me 7 more points to up-vote your answer? We'll soon see. )

(17 Oct '17, 06:31) richiwalt

@richiwalt,

No need to up vote, just "Accept" the answer by clicking the checkmark icon next to it.

P.S. Your "answer" has been converted to a comment as that's how this site works. Please read the FAQ for more information.

(17 Oct '17, 06:58) grahamb ♦