Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have Linux soft-ap running hostapd. I want to collect (from air) list of all packets going to this ap from certain address, or, rather, excluding certain MACs since only one master-managed link needs to be debugged.

Can Wifi WPA connection negotiation be seen from air sniffing?

share|improve this question
up vote 1 down vote accepted

Yes it can be that is how WPA is crackable(you can capture the handshake), though it must be done with the wifi card in promiscuous mode.

share|improve this answer

In theory it shouldn't be, because this poses a security risk. In reality, tools like airpcap in aircrack-ng can collect parts of the WPA negotiation process (this is how information is collected to allow for cracking WPA). That said, WPA technology is designed such that you can't directly listen in on another machines' communications with the post. There are only certain breakdowns in this that don't require a significant amount of effort (and I'm not sure if there are any tools built for monitoring and cracking a computer's complete negotiation process off the air, although you could probably do this based on the information that airpcap collects).

I'd think there's some way to do this at the AP, but I have no idea what that is.

share|improve this answer
With AP, I can go to hostapd logs, but hardly have the idea, if the card itself broadcasts all needed packets. – kagali-san Jan 17 '11 at 6:40

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.