Monitor mode checkbox not working on Debian Sid

Question

Hello, I'm using Debian, when I go to "Capture Options" and select the wlan0 interface, if I try to set it to monitor mode clicking on the checkbox "Capture packets in monitor mode", the "Link-layer header type" menu blinks for a second and the checkbox remains blank. The "Link-layer header type" menu shows only two options: "Ethernet" and "DOCSIS", with both options the monitor mode checkbox has the same behaviour. If I do the following:

ifconfig wlan0 down
iwconfig wlan0 mode monitor
ifconfig wlan0 up

then the only option in the "Link-layer header type" menu is "802.11 plus radiotap header" but the behaviour of the monitor checkbox remains the same. Does anyone have any idea about what the problem is? Thanks in advance.

Accepted Answer

OK, this is a combination of several problems:

Debian sid does not build libpcap 1.1.1 with libnl, which means that libpcap's monitor-mode APIs don't support the Shiny New mac80211 Mechanism, and end up using the old Wireless Extensions stuff;
libpcap 1.1.1's code to use the old Wireless Extension stuff to handle monitor mode had a number of bugs, which means that its monitor-mode APIs don't work correctly when using the old Wireless Extension stuff, and cause dumpcap to report an error;
Wireshark wasn't reporting the error it got from dumpcap in that case - it was briefly disabling the "monitor mode" checkbox (because its attempt to get information such as the link-layer header types in monitor mode failed because libpcap couldn't put the interface in monitor mode), then clearing the checkbox (because it failed to put the interface in monitor mode), and then re-enabling it (because the API it originally used to check whether monitor mode was supported without actually attempting to put the interface into monitor mode said monitor mode is supported).

I've checked into the trunk and 1.6 branches a fix for the third problem; it should now pop up an error message box if you try to check the monitor mode checkbox on platforms with the libpcap problems in question. The error message will refer you to the CaptureSetup/WLAN page in the Wireshark Wiki, but it should really specifically refer you to the Linux section of that page. I'll fix it to do so later. The 1.6 branch changes should also go into 1.4, so they show up in the next 1.4.x release as well as the next 1.6.x release.

I've checked into the libpcap trunk and 1.2 branches a fix for the second problem, so they should show up in any future 1.2.x release (there are enough bug fixes that tcpdump.org should consider doing a 1.2.x release - and announce it so that various OSes pick it up) as well as any 1.3.0 release when it comes out. When that'll happen, I don't know, and I don't know whether any of the Linux distributions with this issue would pick it up as an update to existing releases or whether you'd have to wait for a future release. Given that anything short of Sid appears to have Wireshark 1.2.x as the Wireshark version, people who run into this are probably building Wireshark from source anyway, so they might end up picking up the fix for the third problem - monitor mode won't work well with the checkbox or the -I option, but at least it'll let you know something went wrong and point you at the Wireshark Wiki, which suggests using airmon-ng in that case.

I've sent mail to Romain Francoise, the Debian maintainer for libpcap, about the first problem. Hopefully the fix is as simple as declaring libnl to be one of libpcap's dependencies.