1

I mean, I just want to put my wireless card interface into promiscuous mode to scan my wireless network I'm connected to. Do I necessarily need a monitor mode wifi card compatible?

Should I necessarily set my interface promiscuous flag on before running Wireshark using its promiscuous mode?

sudo ip link set wlan0 promisc on

I've already tried that without having a monitor compatible card without success. I only recieve broadcast and multicast packets.

1 Answer 1

1

(Disclaimer: May contain errors. Please fix if you know the networking stuff better.)

Promiscuous mode doesn't imply monitor mode, it's the opposite:

  • "Promiscuous mode" on both WiFi and Ethernet means having the card accept packets on the current network, even if they're sent to a different MAC address.

  • "Monitor mode" is WiFi-specific and means having the card accept packets for any network, without having to be associated to it.

Note that both modes only tell the card to accept packets – they don't tell the upstream network to send packets in your direction. Ethernet switches normally won't send packets through your port (or your WiFi AP's port) if they know that the recipient is actually connected to another port.

Finally, every network sniffer out there – including Wireshark – will enable promiscuous mode automatically. Monitor mode, however, needs to be enabled manually as it's often driver-specific, and yes, many cards don't support this mode. (I've had good luck with Atheros ath9k series.)

The airmon-ng script from aircrack-ng tries to detect the current driver, but for a start you can try:

iw <device> interface add mon0 type monitor

(where <device> is either the network interface like wlan0 or the physical device like phy0) to create a separate monitor-mode interface. Note that if you remain associated to an AP on wlan0, then you'll only see packets on the same frequency/channel even in monitor mode.

10
  • That's my question. Why should I put my interface in monitor mode if I just want it in promiscuous mode? The problem is that I run Wireshark in promiscuous mode and I only recieve broadcast and multicast packets from the other WLAN computers. Jul 19, 2014 at 19:06
  • @redraw: Re-read what I wrote, please. Nobody said that you should put the interface in monitor mode. Monitor mode won't help: it deals with packets you receive that belong to other SSIDs; it won't do anything if the AP doesn't send you the packets in the first place. Jul 19, 2014 at 20:39
  • 1
    I could sniff packets using ettercap with ARP poisoning and MITM: I recieved the packets from the victim and fowarded them to the router. So, why promiscuous mode wouldn't see those packets just listening on my wifi network area (without arp spoofing/mitm)? Jul 20, 2014 at 2:53
  • 1
    All PCs are connected via WiFi to the wireless router! When doing MITM I was recieving them actually, but I think should be able to see them only by setting my interface in promiscuous mode, right? Jul 20, 2014 at 3:30
  • 1
    @redraw MITM with Ettercap worked on my WPA2 protected network compared to promiscuous mode with Wireshark where I did not receive others traffic (not even encrypted with the need of Wireshark decryption wpa-pwd). Like you, I think we should see others traffic in promiscuous mode on the same WiFi network without MITM attack. From my experience, I know that my laptop card is compatible with monitor mode (don't know for promiscuous mode) because I was able to sniff HTTP requests of an open Wifi network without being connected.
    – baptx
    Jan 18, 2015 at 0:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .