I've got a non-PC wireless client, and I'm wondering about some of its connections. I want to see the actual packets being exchanged from the net to my device over a Wi-Fi connection.
I have Wireshark running on a PC and am watching traffic go by on the network, but whenever the device loads information from the net, it doesn't show up on the sniffer. I have it set to promiscuous mode, but still nothing.
Does anyone know how to make something be seen by a packet sniffer?
That's all way too hard if you're using Linux. Most wireless cards nowadays support monitor mode, which allows to use them to capture all packets, including 802.11 Management and Control frames, on a single channel.
If your wireless card supports this mode (chances that it does), then do the following (I assume that you are using a Debian-based distro:
$ sudo su
# aptitude install aircrack-ng
# airmon-ng start wlan0
# airodump-ng mon0
At this point, you should see a list of wireless networks and connected clients. Note the channel number on which your network/client is running. You'll need it to lock your NIC on a particular channel: now it switches all channels sequently to detect every network.
^C
# airodump-ng mon0 -c $channel
You don't really need any of airodump-ng output, it is just used to set channel. Also you can use iw/iwconfig to use it or just connect to the network (yes, you can simultaneously be connected to a network and use monitor mode), but this is easiest and error-prone way.
Now you can start Wireshark and point it to mon0 interface. You'll be able to see all packets travelling through your network. If you want to see only data packets, use this filter: wlan.fc.type_subtype == 0x20.
As a note, I want to say that this is probably possible on Windows, but is harder and range of supported adapters is much narrower, as there are no standard API for monitor mode in Windows.
I've run into this as well. I have a managed switch inside my wired/wireless router, mirroring all traffic to a sensor port that I route into a secondary NIC on my main PC, which allows me to see basically all traffic, except wireless. One solution I'm considering is to add another managed switch (they're surprisingly cheap these days) outside the router, between the modem and the router, which will allow me to capture the wireless traffic. There's just one problem: it will also see a ton of useless traffic from the Internet that is otherwise ignored by the router and which I don't usually see at all. I'm not sure if this qualifies as an answer, but I'm definitely interested in what everyone else has to add on this topic.
Depending on what you are looking for - ARP poisoning might be the solution. That way you could capture the packets and examine them... They will be a little bit different than original ones (IP headers will have your computers IP as incoming/outgoing depending on if they are going out or into your network, but it does not matter... packets will stay the same and you'll be able to recognize what you need).
