Capturing Link layer frames

Question

I've been trying to capture link layer frames. I've tried using wireshark (also tcpdump and airmon-ng) both in monitor mode and managed mode (/promiscuous mode), yet have been unable to see them. Put them on the same channel, made no difference. It shows data packets, and some [tcp] acknowledgements, but I've understood that the actual link layer frames and management frames are "inside" those.

So I guess the question is, is it possible to make these frames visible individually? Or are the drivers limiting what CAN be seen, in which case does it depend on the hardware? I would like to see the link layer interactions frame by frame.

Answer 1

Here is what you can see with wireshark (or any other similar tool):

Promiscuous mode:

• IEEE802.11 data frames exchanged between your client device and the access point (you won't see any traffic between other clients and the access point on the same network). The data frames don't show up as layer 2 frames but are already presented in the higher layer protocols (e.g. TCP, UDP, DNS, etc.) that are contained in the data frame.

Monitor mode (without providing the pre-shared key for a WPA2 secured connection)

• IEEE802.11 management frames on the selected channel that are not encrypted (e.g. beacon frames from all access points in range, probe request frames from clients in range, etc.)

Monitor mode (providing the pre-shared key for a WPA2 secured connection and capturing the 4-way WPA2 handshake between a client device A and the access point)

• IEEE802.11 management frames on the selected channel that are not encrypted (e.g. beacon frames from all access points in range, probe request frames from clients in range, etc.)

• IEEE802.11 data frames exchanged between client A and the access point (you won't see any traffic between other clients where the handshake was not captured).

Please find here more details regarding monitor mode/promiscuous mode in Wireshark and how to enter the psk.