Only seeing broadcast traffic in WiFi captures

Question

I'm having trouble capturing anything other than WiFi broadcast traffic.

Here's my setup:

• Kali Linux virtualized with Parallels on macOS 10.14: 4.19.37-6kali1 (2019-07-22)
• Alfa Network AWUS036NHA USB WiFI adapter (passed through to the VM, not used by the host OS)
• lsusb shows me: Qualcomm Atheros Communications AR9271 802.11n
• lsmod | grep 80211 gives

mac80211              815104  1 ath9k_htc
cfg80211              761856  4 ath9k_htc,ath9k_common,ath,mac80211
rfkill                 28672  5 bluetooth,cfg80211

The adapter shows up in iwconfig as wlan0.

Here's how I put the adapter into monitoring mode:

> airmon-ng check kill
> airmon-ng start wlan0

PHY Interface   Driver      Chipset

phy1    wlan0       ath9k_htc   Qualcomm Atheros Communications AR9271 802.11n

        (mac80211 monitor mode vif enabled for [phy1]wlan0 on [phy1]wlan0mon)
        (mac80211 station mode vif disabled for [phy1]wlan0)

> iwconfig

wlan0mon  IEEE 802.11  Mode:Monitor  Frequency:2.457 GHz  Tx-Power=20 dBm   
          Retry short limit:7   RTS thr:off   Fragment thr:off
          Power Management:off

I'm now setting it to the channel of the AP I want to listen to: iwconfig wlan0mon channel 3 and I can verify that iwconfig now shows Frequency:2.422 GHz. For testing purposes I also locked my AP on this channel.

I'm now starting Wireshark and start capturing on wlan0mon. My host machine and also the kali vm are not connected to any network at this point.

I can see all kinds of management and control frames but not much more as my target network is encrypted. So I take another physical client and connect to the AP and can see the EAPOL packets being captured; from then on I start seeing the decrypted traffic (my key is stored in Wireshark).

The problem is: I'm only seeing broadcast traffic: ARP, some UDP broadcasts, MDNS, ICMP Router advertisments, etc.. When I use my other client and produce some traffic (constant pinging/ICMP, HTTPs traffic, etc.), it just doesn't show up / is not captured.

When I put my adapter back into managed mode and join the network myself, capturing works fine (obviously, then just for my machine's traffic). Worth noting, I have the same issue here, when I do not disconnect my host machine first, even though it's using it's own WiFi adapter (i.e. also only capturing broadcast traffic).

Any idea what could cause this problem / why only broadcast traffic is captured?

(Capturing the packets with airodump-ng instead of Wireshark makes no difference – also only seeing broadcast).

Answer 1

You can't capture frames that were transmitted using modulation and coding schemes that your capture hardware doesn't understand. Your capture hardware is non-MIMO (1x1:1), so it can't capture anything sent using two or three MIMO spatial streams. I suspect your target client and AP are both at least 2x2:2 capable.

"From DS" multicasts and broadcasts are sent at low rates for reliability because they are not Acked. So those are probably being sent using a slow non-MIMO modulation. Which is why you're seeing multicasts and broadcasts but not unicasts.

Management and control frames, and even the EAPOL handshake, are often sent at lower PHY rates for reliability as well. But after the EAPOL handshake is done and real unicast traffic starts to fly, the hardware starts using the highest MCSes both ends support and that the RF conditions allow them to use reliably.