How to debug Wifi?

Question

I have Linux soft-ap running hostapd. I want to collect (from air) list of all packets going to this ap from certain address, or, rather, excluding certain MACs since only one master-managed link needs to be debugged.

Can Wifi WPA connection negotiation be seen from air sniffing?

Answer 1

Yes it can be that is how WPA is crackable(you can capture the handshake), though it must be done with the wifi card in promiscuous mode.

Answer 2

In theory it shouldn't be, because this poses a security risk. In reality, tools like airpcap in aircrack-ng can collect parts of the WPA negotiation process (this is how information is collected to allow for cracking WPA). That said, WPA technology is designed such that you can't directly listen in on another machines' communications with the post. There are only certain breakdowns in this that don't require a significant amount of effort (and I'm not sure if there are any tools built for monitoring and cracking a computer's complete negotiation process off the air, although you could probably do this based on the information that airpcap collects).

I'd think there's some way to do this at the AP, but I have no idea what that is.