How to make Wireshark show http format instead of 802.11 or check if Wireshark is capturing it

Question

First of all, this might look like a duplicate from this post, and it kind of is, but at the time writing my rep is not high enough to comment and I was walking in to some issues whilst applying that answer.

I have set up an open WiFi AP (testing-hotspot) and I'm trying to sniff WiFi traffic coming from and going to it. I connected to it with my phone and loaded up a non secure testing website (just HTTP, no SSL or whatsoever) and filled in a password form.

I expected to see it appear in Wireshark but it didn't. After I did some research regarding my issue I came across the aforementioned question and tried the there given answer, typing http in the filter box with no results, just an empty screen. It does intercept date from the AP because it shows SSID=testing-hotspot. Does anyone know what is causing this and how I can fix this?

--Edit:

I've added a screenshot

I would like to know how I can see HTTP, TCP, UDP and so forth packets instead of 802.11

Answer 1

Your screenshot only shows beacon frames, not actual data between your phone and the AP.

So either (1) you are capturing the wrong wifi interface, or (2) you didn't show us the captured non-beacon frames, or (3) your phone wasn't connected to your testing-hotspot, but to some other AP, or (4) your whole setup is in a way that you don't capture data between the phone and the AP.

Note that you won't see traffic between other clients and the AP on WLAN, so if you are capturing this on a client different from your phone, it is not going to work.

You either need to capture the traffic on the phone, or on the AP itself. And the AP must be configured to forward the packets to some other network interface, e.g. LAN. If you bridged an WLAN-AP to a WLAN-STATION, you may not see any packets.

Answer 2

The monitor able adapter you use must support not only the band, but also the MIMO and modulation modes which are used by your connection you want to inspect.

Also important is, to choose the correct channel with the command

iw dev <name of interface which is in monitor mode> set channel <channel number the AP or client tells you> <channel mode you have to try>

This ensures you get exactly the interesting packets.

You can list allowed channel modes with

iw dev <name of interface which is in monitor mode> set channel help

Further you need to setup decryption in Wireshark. For WPA2:

Preferences/Protocol/IEEE 802.11/Enable decryption and then Edit.

You need to enter WPA-PWD in the Format "WiFi-Pwd:SSID". Please ensure to see all 4 EAPOL packets between your AP and your client. That is a prerequsite to see the payload at all.

It is not easy to get a 100% result. Please count on to see only one direction, the other is missing.