I'm having trouble capturing anything other than WiFi broadcast traffic.
Here's my setup:
- Kali Linux virtualized with Parallels on macOS 10.14: 4.19.37-6kali1 (2019-07-22)
- Alfa Network AWUS036NHA USB WiFI adapter (passed through to the VM, not used by the host OS)
Qualcomm Atheros Communications AR9271 802.11n
lsmod | grep 80211gives
mac80211 815104 1 ath9k_htc cfg80211 761856 4 ath9k_htc,ath9k_common,ath,mac80211 rfkill 28672 5 bluetooth,cfg80211
The adapter shows up in
Here's how I put the adapter into monitoring mode:
> airmon-ng check kill > airmon-ng start wlan0 PHY Interface Driver Chipset phy1 wlan0 ath9k_htc Qualcomm Atheros Communications AR9271 802.11n (mac80211 monitor mode vif enabled for [phy1]wlan0 on [phy1]wlan0mon) (mac80211 station mode vif disabled for [phy1]wlan0) > iwconfig wlan0mon IEEE 802.11 Mode:Monitor Frequency:2.457 GHz Tx-Power=20 dBm Retry short limit:7 RTS thr:off Fragment thr:off Power Management:off
I'm now setting it to the channel of the AP I want to listen to:
iwconfig wlan0mon channel 3 and I can verify that
iwconfig now shows
Frequency:2.422 GHz. For testing purposes I also locked my AP on this channel.
I'm now starting Wireshark and start capturing on
wlan0mon. My host machine and also the kali vm are not connected to any network at this point.
I can see all kinds of management and control frames but not much more as my target network is encrypted. So I take another physical client and connect to the AP and can see the EAPOL packets being captured; from then on I start seeing the decrypted traffic (my key is stored in Wireshark).
The problem is: I'm only seeing broadcast traffic: ARP, some UDP broadcasts, MDNS, ICMP Router advertisments, etc.. When I use my other client and produce some traffic (constant pinging/ICMP, HTTPs traffic, etc.), it just doesn't show up / is not captured.
When I put my adapter back into managed mode and join the network myself, capturing works fine (obviously, then just for my machine's traffic). Worth noting, I have the same issue here, when I do not disconnect my host machine first, even though it's using it's own WiFi adapter (i.e. also only capturing broadcast traffic).
Any idea what could cause this problem / why only broadcast traffic is captured?
(Capturing the packets with
airodump-ng instead of Wireshark makes no difference – also only seeing broadcast).