Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've just installed Wireshark on my laptop and can't see it's working in "monitor mode". Logically I'm not connected with my home network, do I have to be able to monitor my ipads traffic?

WinPCAP was installed during installation of Wireshark, and I have rebooted.

Is my device supported, and are there other settings I need to set (in Windows maybe?)

share|improve this question

1 Answer 1

up vote 2 down vote accepted

Monitor mode is not supported by WinPcap, and thus not by Wireshark or TShark, on Windows. It is supported, for at least some interfaces, on some versions of Linux, FreeBSD, NetBSD, OpenBSD, DragonFly BSD, and Mac OS X.

If you are running Wireshark 1.4 or later on a *BSD, Linux, or Mac OS X system, and it's built with libpcap 1.0 or later, for interfaces that support monitor mode, there will be a "Monitor mode" checkbox in the Capture Options window in Wireshark, and a command line -I to dumpcap, TShark, and Wireshark.

In Wireshark (Supported OS), if the "Monitor mode" checkbox is not grayed out, check that check box to capture in monitor mode. If it is grayed out, libpcap does not think the adapter supports monitor mode. If it is not an 802.11 adapter, it cannot support monitor mode; if it is an 802.11 adapter, either the adapter does not support monitor mode, the adapter's driver does not support monitor mode, or there's a bug in libpcap causing it not to think the adapter and driver support monitor mode.

Source of Information

Most cards are Not supported for monitor mode and Windows

Chipsets/Cards that support monitor mode or have hacked drivers that allow it Atheros seems to be one of the favorites on that page for Windows.

These older wireless adapters are considered some of the best, but may be hard to come by or have legacy hardware connections you PC does not support (ie. pcmcia slot).

Some wireless adapters are better suited to sniffing packets than others. Not all adapters can properly detect and report errors and others have drivers that are not very suited to packet sniffing. Cisco Aironet cards, Prism II cards, and Orinaco Silver and Gold cards are considered the best cards to perform monitoring from, but they are only a few of many that have the capability and the proper drivers available. Research which cards are available for the operating system to be used and procedures necessary for their driver install before purchasing any card.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.