I am doing some tests for my project, and I am connected to my Access Point (which is open; no security) wirelessly.

Theoretically, when I start a capture in promiscuous mode, Wireshark should display all the packets from the network to which I am connected, especially since that network is not encrypted. But what happens is that Wireshark only shows the packets for which I am the source or the destination; it never shows other clients’ packets (unless they are broadcast packets).

So what is the problem? I have been facing this problem for a long time, and it is preventing me from continuing my project. First, I was trying to do some sniffing on WPA2-encrypted wireless networks, but it didn't work, so now I am just trying to sniff an open network to understand the problem, but I am facing the same problem with open networks.

Here is some notes about my configuration :

  • I am using Ubuntu 15.10 (with Linux version >4);
  • I am using Atheros AR9462 wireless card;
  • My Access point is using the standard 802.11g (I configured it myself on the AP conifiguration interface).
  • I am 2 meters away from the AP, and the other clients that are connected to the same AP are in the same range as me (2 meters)

Please don't tell me about the monitor mode, because I can already sniff successfully in that mode. My project is about sniffing in promiscuous mode, so that's what I am trying to do (and I am failing like an idiot).

EDIT : I just tried with the wireless card Realtek 8187L chipset Driver on an open 802.11b network, and it isn't working neither. I really don't get what's wrong here.

  • Can you explain why you think this will work? What do you think monitor mode is for? – David Schwartz Mar 15 '16 at 23:00
  • 1
    @DavidSchwartz 802.11 monitor mode is for seeing 802.11-style headers and 802.11-specific frame types (management and control frames). Promiscuous mode on a Wi-Fi interface should act exactly like promiscuous mode on a wired Ethernet interface connected to a hub or port mirroring/spanning switch: show you all Data frames (including QoS Data) on the network, regardless of receiver MAC address, after the frames have been translated from 802.11-style headers to Ethernet-style headers. – Spiff Mar 15 '16 at 23:11

Some possible causes you'll need to eliminate as possibilities:

  • Perhaps there are no other unicast data frames on your network (no unicast traffic to/from other wireless devices).
  • Your sniffer machine is out of radio range to successfully receive the other unicast data frames on the network. Maybe the other wireless clients are so close to the AP that they're able to use the most complex modulation and coding schemes (top data rates), but your sniffer is far enough away, or so close to a local noise source, that it doesn't have good enough signal-to-noise ratio to successfully demodulate those packets.
  • Your sniffer machine doesn't support the same modulation schemes as the other clients are using. For example, if your AP and client you're trying to spy on both have 3 transmit and 3 receive radio chains and supports 3 spatial streams (3x3:3), but your sniffer is only 2x2:2, then the AP and the client may be using 3 spatial streams, which your sniffer's radio is incapable of receiving. Or maybe your AP and client are 802.11ac, but your sniffer is only 802.11n.
  • Of course it could just be a bug in your wireless chipset or driver.
  • I guess that I should off explain more in my post. So, for the 1st suggestion, there is unicast data frames, because i connected other clients, and tried to connect to the internet with them ; for the 2nd suggestion, both of me and the client are 2 meters away from the AP ; for the 3rd suggestion, I am trying to simplify the AP configuration, so i am using 802.11g only on the AP, and it is a very simple AP ; and i don't think that it is the 4th suggestion, because i tried on multiple PCs, and with multiple wireless cards. Thanks for the answer anyway bro. – Sidahmed Mar 15 '16 at 23:16
  • Please, did you try to sniff with promiscuous mode (I really wanna know about promiscuous mode only) on an open wireless network ??!! and if you did try, did you see other clients unicast data packets ??!! – Sidahmed Mar 15 '16 at 23:18

Theoretically, when I start a capture in promiscuous mode, Wireshark should display all the packets from the network to which I am connected, especially since that network is not encrypted.

Practically, however, it might not; it depends on how the adapter and driver implement promiscuous mode.

If you're on a protected network, the adapter might be able to show you "third-party" packets if it's protected with WEP, but it'd have to do the same type of decryption that Wireshark does in order to show you "third-party" packets for WPA/WPA2, and perhaps they just don't bother. (And "show you" means that, if it's going to show you "fake Ethernet" headers, it'll have to generate the "fake Ethernet" header, which means it needs to look at the 802.2 header, and SNAP header if present, in data packets, and that means it needs to decrypt those headers.)

Given that, they might not have bothered implementing promiscuous mode even for open networks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.