The scenario involves an Android mobile device, a networked air conditioner unit, and Wireshark running on a MacBook Pro.

All three devices are on the same wifi network. The wifi router is a Google Wifi and its management interface shows all three devices connected to it. The router displays the AC unit IP address. I can use the Android device to control the AC unit over the wifi network.

If I create a new capture configuration in Wireshark on the MacBook and use default settings, including promiscuous mode, set the filter to "host" (i.e. the AC unit IP address), start capturing, then send a command from the Android device over the wifi to the AC unit, the AC unit responds to the network command, but no traffic is captured by Wireshark.

How do I capture the traffic between the Android device and the AC unit in Wireshark? I do not understand why the traffic (which is certainly being sent and received) is not being picked up by Wireshark (or possibly the MacBook's network interface).

My goal is to capture these packets in order to build an Android Things client to replicate those network commands to control the AC unit in different scenarios.

  • Is your network protected by WPA2 or some other form of encryption? If so, did you enter the network passphrase into Wireshark’s WPA2 decoder UI? And did you capture the key handshake when each device joined the network? – Spiff May 10 '18 at 16:31
  • You may want to add a filter to capture the mac address instead of the IP address. Use eth.addr or eth.src. Also make sure Wireshark is capturing ALL the packets on the channel (and not the laptop packets only) you have assigned to capture on Wireshark. – pythonian May 10 '18 at 16:50
  • @Spiff Yes, WPA2. I looked under Preferences->IEEE802.11 and tried adding a wpa-pwd entry in the form "networkpassphrase:networkname" but Wireshark doesn't accept that. I added a wpa-pwd entry with just the passphrase as a value, Wireshark accepted that, but still no packets are captured. – Ollie C May 10 '18 at 17:00
  • @pythonian I tried filtering on mac address, but saw no results. It seems the MacBook isn't seeing the packets at all. How do I configure Wireshark to capture all packets, rather than just the laptop packets? The Wireshark capture is set to Promiscuous mode, and Monitor is enabled. – Ollie C May 10 '18 at 17:04
  • 1
    @pythonian I found an old Android device that only supports 2.4GHz, switched the MacBook to channel 6 as you suggest (a wifi analyser showed ch6 was being used) and with a Wireshark filter of "wlan.sa == <mac> || wlan.da == <mac>" I can see the traffic. Many thanks for your help. If you want to add an answer that suggests enabling monitor mode, promiscuous mode and making sure all devices are on the same wifi channel, I will happily mark it as accepted. Thanks again. – Ollie C May 11 '18 at 8:09

Make sure that all three devices are on the same wi-fi channel. Launch Wireshark, select the Wireless Interface then click on Capture Option (black icon in the toolbar). Make sure Promiscuous Mode and Monitor are both checked as enabled. Once you click start, your Macbook wifi icon (top right) should turn into an eye and you should start seeing all packets including beacons. At this point, you can apply your filter by mac address and you should start seeing packets for that mac address only.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.