Environment: Home network that operates on channel 8 (I am the admin so all the passwords are known and I have physical access to all devices), with a PC and a laptop connected to it (both standing about 20 cm from the router)
Objective: Use a wireless module on the PC (running Linux in a VM) to sniff the traffic of the laptop
Problem: Captured data is not as expected
I use a RaLink RT5370 wireless module, which in turn uses the rt2800usb driver part of the kernel. Here's the output of iwconfig
:
mon0 IEEE 802.11bgn Mode:Monitor Tx-Power=0 dBm
Retry short limit:7 RTS thr:off Fragment thr:off
Power Management:off
And here's the output of ip link
:
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
3: mon0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UNKNOWN mode DEFAULT group default qlen 1000
link/ieee802.11/radiotap 00:e1:b2:00:36:79 brd ff:ff:ff:ff:ff:ff
I've tried to capture traffic in numerous ways, but I prefer to use tcpdump:
tcpdump -n -w test.pcap -i mon0
After I've started capturing on the PC, I would usually turn on the laptop, join the network (so that I can capture the EAPOL handshake), browse the Internet a bit, and then stop the capturing. Now here's where my problems begin. I load the captured traffic into wireshark and I notice that in the approximately 1 minute, that the laptop was using the network, I've managed to capture about 600 to 700 packets. The vast majority, about 98% of them, are Beacon Frames broadcasted from the router. Looking at my last attempt, 643 packets were captured, out of which 638 (99.2%) were broadcasts and 5 were multicasts, originating from the laptop. So all in all, nothing useful has been recorded. What could the problem be and how could I capture unicasts between the laptop and the router?
Most of the documentation online seems to be concerned with setting up the network interface in monitor mode and decrypting the recorded traffic, but I've already nailed the former, I believe, and the latter is of no use to me if I've got no meaningful traffic to begin with.
tl;dr tcpdump seems to capture all rubbish, how do I make it capture unicasts?
Note: The OP from this question (Why Wireshark is not showing high layer packets like ICMP/IP/UDP? (Only broadcast packets are shown)) seems to be having similar issue but it's almost three years old and the suggested cause (hardware) seems not applicable to my case as I am using a completely different device.