Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using Wireshark for 802.11g sniffing. The AP is not using any encryption. These are my observations:

  1. The vast majority packets are beacons and the probe requests.
  2. If I filter out beacons using the filter !(wlan.fc.type_subtype==0x08), I can see some ARP, ICMPv6, IGMPv3 and DHCP packets. These packets mostly came when a fresh connection is made from a station to an AP.
  3. When I do Ping or telnet, I cannot see any Data packets, even when the Ping/telnet operations are clearly going on and successful.
  4. Basically Only broadcast packets get displayed. (One exception is some packets are shown with Destination Address being Cisco_00:00:00/01:0b:85:00:00:00).

Anybody knows what went wrong?

My Wireshark version is 1.8.2. I am using a Ubuntu 12.10 and a USB wireless adaptor Belkin F5D7050. I have put the wlan interface to monitor mode with airmon-ng start wlan1.

(Update: It looks like a driver or hardwara issue. There are some similar discussions like here.)

share|improve this question
Did you run Wireshark on wlan1 or mon0? Only the latter is a monitor interface. – grawity Apr 29 '13 at 19:34
It's mon0. wlan1 is not even shown in the Wireshark Capture Interfaces dialog. – xiaobai Apr 29 '13 at 19:40

You're probably capturing on a "protected" network, i.e. one using WEP or WPA/WPA2 encryption, and Wireshark can only dissect the payload of those frames if it has enough information to decrypt them. The "How to Decrypt 802.11" page of the Wireshark Wiki explains this in detail.

share|improve this answer
No. I am not using any encryption. I just updated my question. And if I were using encryption, I could have at least seen some Data packets. But now if I filter out the AP's beacon message, I couldn't see any packets when I do Ping or telnet. – xiaobai Apr 29 '13 at 19:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.