In order to capture inbound/outbound WiFi traffic from another wireless device, we need to configure the device in question to use a network connection that we can monitor with tools such as Wireshark. To make things simple, I will be using the WifiShare tool to accomplish this task. Relevant articles. Capturing interesting network packets. This is something you can’t do on Windows with Wireshark except if using AirPCAP adapters. Monitor Mode is basically turning your WiFi card into a “receive only” listening device for radio waves (which also means you cannot use it to communicate with the network while it’s in that mode), and is required to see packets from and to other devices.
At a recent course I taught in New England, one of the students wanted to capture Wi-Fi packets on their Windows Surface Pro. Of course, I referred them to my article on. The student tried this and was not able to properly configure Microsoft Network Monitor to do the job on the Windows Surface Pro platform always a mystery to me about the complexities of Microsoft. I suggested they try using Linux instead, to get around whatever difficulty Microsoft built into the Surface. They tried a Linux virtual machine (VM) and had no luck with this either.
They then even tried booting Linux from a bootable disk with no luck. Finally, they tried capturing on a different machine that ran Linux as it's primary operating system and had difficulty as well. I am sure others have suffered through this, in my opinion, needless pain. One horribly expensive option is to buy an Apple! You can easily put your interfaces into monitor mode and MAC-OS. OK, ok, not an option. Let's look at the possibilities.
The issue here is we are trying to do two things:. We want to use the wireless interface on the host machine. We need to be able to put the Linux machine into monitor mode so we can see the Wi-Fi traffic. Further, we have the issue of virtual networking in either VirtualBox or VMware. We also have the problem of multiple distributions of Linux. I am going to deal with two: Ubuntu and Kali Linux.
So as you can see this is messy. I hope that my answers either help or if not, that when others find further details they will add comments below.
But before I do, if you have Wireshark loaded onto your Linux OS and cannot see any interfaces like shown below (interfaces should show up in the center white area): Make sure you read this article: That said let’s move on. Dealing with Virtualized Environments If you run Linux in a virtual environment such as VirtualBox or VMware, you will be in for a bit of a surprise. Both these environments allow you to configure the network settings for each virtual machine. Both will bridge the Wireless interface to your Linux VM, which is the way to get your VM to use the Wireless interface. However, in the latest versions, they both do this through a bridge module, and so your VM will only see the interface as a regular ethernet connection.
This means you cannot access the Wireless interface directly through the VM to put it in monitor mode. If anyone has a workaround for this, let me know and I will change this article. The best way to solve this problem is to have a bootable USB running Linux, and then boot your Windows system on the USB. ( ) You can then configure that system as shown here. Accessing the Wireless Interface in Linux on a Stand Alone System It is important to know if you can see the wireless interface in your Linux environment. To check this, open a terminal window and enter the following command: iwconfig You should see an output that displays your system network interfaces that support wireless extensions: You can see above, i was using Kali Linux - it is running on a stand alone laptop.
You can see my wireless interface is called wlan0. Some of you may see the wireless interface as eth1. Newer versions of Linux now use the wlo1 nomenclature. If you look closely at the second line, it says 'Mode: Managed'. This means the system is attached to an Access Point and is operational.
It is followed by a bunch of physical layer information on the connection. On newer Linux systems it may look like this (note the WLAN interface is not 'wlan0' but now 'wlo1': Now the next step is to put the interface into Monitor mode. I was a superuser so I did not have to use 'sudo', but you may have to do this on your Linux box. Simply add 'sudo' before all the commands below: To do this you will see I tried above to type the command: iwconfig wlan0 mode monitor And you see I got an error. So I tried it with 'sudo' and got the same error. The problem here is I need to take the interface offline first.
![Can Wireshark Sniff Wifi Traffic Can Wireshark Sniff Wifi Traffic](/uploads/1/2/5/4/125407806/963886844.png)
So the next command I entered ' ifconfig wlan0 down' Then I tried once again to put the interface into monitor mode, and it worked. If you are not the superuser, you may need to use 'sudo' in front of these commands. Lastly, I brought the interface back up with ' ifconfig wlan0 up'. In newer versions of Linux with the new interface nomenclature you need to replace 'wlan0' in the above commands with 'wlo1'. So the commands would be: sudo iwconfig wlo1 down sudo iwconfig wlo1 mode monitor sudo iwconfig wlo1 up Now let's run wireshark and capture on the wireless interface: Looks perfect, and I can see the Wi-Fi control frames.
Now to return the interface to normal, you need to shut it down, return it to managed mode and then bring it back up: ifconfig wlan0 down iwconfig wlan0 mode managed ifconfig wlan0 up Just replace the 'wlan0' with 'wlo1' for the newer versions of Linux. All of this should work on any version of Linux.
Some Other Linux and Wi-Fi Stuff I had one person tell me that they could not put their hardware into monitor mode, so I had them check a few things. First, there is an additional command in Linux called the ‘iw’ command that was to have replaced iwconfig, and it is a little different.
Let’s try it: root@kali:# iw dev phy#0 Interface wlan0 ifindex 3 wdev 0x1 addr 00:1b:fc:51:4d:a0 type managed channel 11 (2462 MHz), width: 20 MHz (no HT), center1: 2462 MHz Nice! We see the interface is wlan0, we see the MAC address, that we are in managed mode on channel 11 with the channel width and center frequency.
You can get deeper information with the ‘ iw phy phy0 info‘ command: root@kali:# iw phy phy0 info Wiphy phy0 max # scan SSIDs: 4 max scan IEs length: 2285 bytes max # sched scan SSIDs: 0 max # match sets: 0 Retry short limit: 7 Retry long limit: 4 Coverage class: 0 (up to 0m) Device supports RSN-IBSS.
Here are some suggestions:. For Android phones, any network: Root your phone, then install tcpdump on it. Is a tcpdump wrapper that will install tcpdump and enable you to start captures using a GUI.
Tip: You will need to make sure you supply the right interface name for the capture and this varies from one device to another, eg -i eth0 or -i tiwlan0 – or use -i any to log all interfaces. For Android 4.0+ phones: uses the USB OTG interface to support packet capture without requiring root.
I haven’t tried this app, and there are some restrictions on the type of devices supported (see their page). For Android phones: uses the Android VPN service to intercept packets and capture them.
I have used this app successfully, but it also seems to affect the performance with large traffic volumes (eg video streaming). For IOS 5+ devices, any network: iOS 5 added a remote virtual interface (RVI) facility that lets you use Mac OS X packet trace programs to capture traces from an iOS device. See for more details. For all phones, wi-fi only:, then run wireshark on the PC. For all phones, wi-fi only: Get that can sniff wi-fi. This has the advantage of giving you 802.11x headers as well, but you may miss some of the packets. Capture using a VPN server: Its fairly easy to using OpenVPN.
You can then route your traffic through your server by setting up the mobile device as and capture the traffic on the server end. Wireshark + OSX + iOS: Great overview so far, but if you want specifics for Wireshark + OSX + iOS:. install Wireshark on your computer. connect iOS device to computer via USB cable. connect iOS device and computer to the same WiFi network. run this command in a OSX terminal window: rvictl -s x where x is the UDID of your iOS device.
You can find the UDID of your iOS device via iTunes (make sure you are using the UDID and not the serial number). goto Wireshark Capture-Options, a dialog box appears, click on the line rvi0 then press the Start button.
Now you will see all network traffic on the iOS device. It can be pretty overwhelming. A couple of pointers:. don’t use iOS with a VPN, you don’t be able to make sense of the encrypted traffic.
use simple filters to focus on interesting traffic. ip.addr204.144.14.134 views traffic with a source or destination address of 204.144.14.134. http views only http traffic Here’s a sample window depicting TCP traffic for for pdf download from 204.144.14.134.