Is monitor mode possible for just one SSID?

Question

Is it possible to put the WiFi adapter on a Linux box into monitor mode and then tell it to join a specific WPA2-protected network, so that I might sniff all wireless traffic on that network?

I'm trying to set up something like the Driftnet picture frame project from a few months ago.

However, there are a few key differences which are preventing me (thus far) from completing this successfully:

• I want to run this on my wireless network.
• My wireless network is using a WPA2 passphrase.
• I know this passphrase (obvious, but just in case).

What I'm trying to do is effectively sniff all of the wireless traffic on my own wireless network. (Think: monitoring kids' use of the Internet.) I know that even encrypted WiFi networks are more or less just hubs, broadcasting all packets to all nodes, but I can't figure out how to see (in decrypted form) the traffic that isn't specifically mine.

I can think of a couple of ways to accomplish this, but I'm not clear on which is best (or, heck, even possible).

It seems to me I could try to get the router to simply echo every packet to another box of my choosing, which would run Driftnet against all of the packets. This seems to involve a lot of overhead on the part of my router, though.

This brings me back around to my original question. It seems that in monitor mode, I get everything, and worse, all in encrypted form. Even though I own this network and therefore know the passphrase, there doesn't seem to be any way to post-process the captured packets and decrypt them before they reach Driftnet.

I'm the first to admit my understanding of some of the wireless technologies is a bit sparse, so maybe I'm missing something very basic here.

Can anyone kindly enlighten me?

Answer 1

I think the easiest way to do this to put the interface in monitor mode, then use wireshark.

In wireshark, enable the wireless toolbar (View menu) and select Wireshark as the decryptor. Then click decryption keys, and select WPA-PWD seeing as you have the passphrase, and enter it along with your SSID.

Then start capturing. Note that to decrypt other peoples traffic, wireshark will need to see their handshake (this shows up as EOPOL in the capture). You may need to restart their wireless session in order for wireshark to see it.

Also, you may need to toggle FCS and the protection bit settings in Edit/Preferences/IEEE 802.11

These are driver dependent, so you may just have to play around before you get it to work.

Answer 2

I have a feeling your plan won't be as reliable as you'd like. You have to try to position your sniffer so that it can reliably receive every transmission from your target client(s) and AP, and you have to make sure that your sniffer is capable of receiving all the same data rates (modulation schemes) as your target and AP are capable of.

If at any time the target client(s) sleep/wake or reauthenticate for any reason, you've got to be sure to catch their key handshake otherwise you won't be able to decrypt their traffic for that session. As @Paul alluded to, WPA2 has per-user, per-session encryption keys that are derived from the PSK plus some random nonces exchanged in that key handshake. If you don't capture the key handshake from the beginning of a target client's session, you won't be able to decrypt his traffic even if you know the PSK. This is one of the things that makes WPA and WPA2 security superior to WEP.