2

Environment: Home network that operates on channel 8 (I am the admin so all the passwords are known and I have physical access to all devices), with a PC and a laptop connected to it (both standing about 20 cm from the router)
Objective: Use a wireless module on the PC (running Linux in a VM) to sniff the traffic of the laptop
Problem: Captured data is not as expected

I use a RaLink RT5370 wireless module, which in turn uses the rt2800usb driver part of the kernel. Here's the output of iwconfig:

mon0      IEEE 802.11bgn  Mode:Monitor  Tx-Power=0 dBm   
          Retry short limit:7   RTS thr:off   Fragment thr:off
          Power Management:off

And here's the output of ip link:

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
3: mon0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UNKNOWN mode DEFAULT group default qlen 1000
    link/ieee802.11/radiotap 00:e1:b2:00:36:79 brd ff:ff:ff:ff:ff:ff

I've tried to capture traffic in numerous ways, but I prefer to use tcpdump:

tcpdump -n -w test.pcap -i mon0

After I've started capturing on the PC, I would usually turn on the laptop, join the network (so that I can capture the EAPOL handshake), browse the Internet a bit, and then stop the capturing. Now here's where my problems begin. I load the captured traffic into wireshark and I notice that in the approximately 1 minute, that the laptop was using the network, I've managed to capture about 600 to 700 packets. The vast majority, about 98% of them, are Beacon Frames broadcasted from the router. Looking at my last attempt, 643 packets were captured, out of which 638 (99.2%) were broadcasts and 5 were multicasts, originating from the laptop. So all in all, nothing useful has been recorded. What could the problem be and how could I capture unicasts between the laptop and the router?

Most of the documentation online seems to be concerned with setting up the network interface in monitor mode and decrypting the recorded traffic, but I've already nailed the former, I believe, and the latter is of no use to me if I've got no meaningful traffic to begin with.

tl;dr tcpdump seems to capture all rubbish, how do I make it capture unicasts?

Note: The OP from this question (Why Wireshark is not showing high layer packets like ICMP/IP/UDP? (Only broadcast packets are shown)) seems to be having similar issue but it's almost three years old and the suggested cause (hardware) seems not applicable to my case as I am using a completely different device.

1 Answer 1

2

To capture, on a Wi-Fi network, unicast traffic not sent to or from the capturing machine, you will probably need to capture in monitor mode. The Wireshark Wiki article on WLAN captures gives a lot of detail on that; the way you capture in monitor mode is OS-dependent - newer versions of libpcap on non-Windows OSes, and current versions of Wireshark, attempt to let you do it by checking a checkbox, but, for various reasons, that doesn't necessarily work on Linux or *BSD, and it doesn't work at all on Windows (to capture in monitor mode on Windows, you'd need to capture with a tool such as Microsoft Network Monitor or use an AirPcap device with Wireshark).

Note that, if the network you're on is "protected", using WEP or WPA/WPA2, you will need to be able to decrypt it; details on that are in the Wireshark Wiki article on decrypting 802.11 - note that, for WPA/WPA2, you will need to capture the traffic that appears when the other hosts associate with the network, so you might have to turn the mobile phones off before starting your traffic capture and turn them back on again after the capture starts. Note also that capture filters work on undecrypted packets, so, if the traffic is encrypted, you can't use capture filters on anything at the IP layer (such as IP addresses) or above, you can only filter at the MAC layer (MAC addresses, frame types, and so forth). You can use display filters once the traffic is decrypted, however.

2
  • While in monitor mode, the WiFi interface should not be associated with a network, so unless your system is wired, or has two wifi NICs, it should be off-line. On my mac, I have to also use the -I flag (capital i, as in India) to get full packet info. Jan 17, 2016 at 1:39
  • Sadly, that's not it. If you read carefully my question, you'd notice that I already operate the device in a monitor mode. What's not shown is that I've set the otherbss as well. Also, it's irrelevant to me whether the network is protected or not, because I can't capture unicast traffic anyway.
    – user546073
    Jan 17, 2016 at 8:07

You must log in to answer this question.