0

I have Wireshark and Aircrack-ng and whenever I capture packets I don't know how to capture packets for a specific network (the network is "2WIRE207"). I need to do this so I can use Aircrack-ng.

1 Answer 1

2

If you want to be able to "filter" the packets from a specific wireless network in Wireshark, you first need to find out the network's MAC address. In Airodump-ng it'll tell you the BSSID on the left side of the screen. For example, if the MAC address turns out to be 00:11:22:33:44:55, in Wireshark you can apply this filter:

eth.addr == 00:11:22:33:44:55

This will make all packets with source and destination addresses of 00:11:22:33:44:55 be displayed, so all network traffic from the specific network will be displayed, nothing more.

However, if you want to be able to do this in Airodump-ng itself, instead of Wireshark, you can use this to tell Airodump-ng what to sniff (and what to leave out):

airodump-ng --bssid 00:11:22:33:44:55 mon0

I also recommend finding out on what channel the network is running, so your network card doesn't "channel hop" around and miss packets too much. to specify the channel, use this (in this case I use channel 6):

airodump-ng -c 6 --bssid 00:11:22:33:44:55 mon0

Hope I helped. Good luck with sniffing packets. :)

3
  • Airodump-ng doesn't work on my Windows. Installed Ubuntu 14.10, going to install Wireshark to it. Nov 16, 2014 at 20:29
  • Yeah, all the tools from Aircrack-ng don't work on Windows. You need to use a Linux distro to use them. Nov 16, 2014 at 20:31
  • That's messed up how Windows beefed up their security from XP. Nov 16, 2014 at 20:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .