I am working with ubuntu 11.10. I am able to setup a monitor device using either iwconfig or airmon-ng, but i am unable to select the monitor mode box in the wireshark capture settings. could anybody help? asked 23 Jan '12, 08:08  red |
One Answer:
Just try capturing on the monitor device without checking the monitor mode box. Checking the monitor mode box causes Wireshark to ask libpcap to set up monitor mode; in Linux distributions where libpcap is not linked with libnl, which includes Debian and its derivatives such as Ubuntu, that doesn't work with libpcap 1.1.0 or 1.1.1, as provided with Ubuntu. Therefore, you need to run airmon-ng to set up the monitor device (as libpcap isn't linked with libnl, it won't set up the monitor device itself) and, as the monitor device is already in monitor mode, there's no need to have Wireshark ask libpcap to put it into monitor mode and, in fact, libpcap's attempt to do so won't work. answered 23 Jan '12, 15:05  Guy Harris ♦♦ |
