Capture/Peek WiFi data traffic?

Question

My goal: I want to analyze the network protocols of a wireless device on my net.

I've successfully set my linux laptop into monitor and promiscuous mode for its wifi interface. I used airmon-ng to create a virtual network wifi interface that is in monitor mode.

And I can successfully use Wireshark to look at the network traffic. But...the WiFi data packets are not disassembled by Wireshark. They're just shown as "data"

Is there any way to watch the network traffic itself at the IP/TCP/http etc protocol levels?

Is the problem that the WiFi is encrypted? Suppose I set my WiFi gateway to be no security. Will Ethershark then be able to show the higher level protocols?

Answer 1

If your WiFi connection is encrypted (WEP, WPA, WPA2), you will have to decrypt it (crack it) to see what is going on, or shut off the encryption. The point of encryption is to prevent someone from monitoring the wireless connection.

Answer 2

After several days of investigation:

1. Connect to a wifi network. Either an open network or an encrypted one where you have the key. (Or use aircrack to get a working key)
2. Use ettercap to install your monitor machine as a man in the middle arp attack between the target machine and the local network's gateway. Blog post.
3. Ettercap can write a file which Wireshark can then read and display. The file will show the traffic to and from the target machine.

Answer 3

You can use tcpdump to dump the network traffic.

In example (type in terminal):

sudo tcpdump -i wlan0

Where wlan0 is your WiFi interface.

Use the following useful parameters at the end, to improve your dumps:

-vvv

(or less v's) it will show you more information about packets by disassembling the information,

-X

show the content of the packets (double X - show even more information)

-nl

faster processing (without DNS and no buffering)

-s1500

show the full packet size

You can use as well some filters like (mixing them with OR or AND keywords):

not udp
not dns
not tcp
arp
not port 80

So my recommended dump with disassembling the traffic information could be:

sudo tcpdump -i wlan0 -s1500 -nl -XX -vvv

(change wlan0 to your network interface like eth0, or anything else)

See man tcpdump for more information.