I'm trying to determine the cause of a communication problem between two devices on my wifi network. I CANNOT install programs on them to determine this.
How can I monitor the traffic between these two devices?
Super User is a question and answer site for computer enthusiasts and power users. It only takes a minute to sign up.Sign up to join this community
First of all, we should know to what kind of packets do we have to sniff. The following explanation supposes that you are interested in sniffing transport layer and above. Furthermore, I also suppose that you have the typical network structure in which you have an AP, which is in the middle of the communication of the two devices.
If you have other Linux OS machine available in which you can install programs it would be possible. Supposing that you already are inside the network with this 3rd machine (Sniffer), you should install arpspoofing and wireshark:
sudo apt-get install arpspoof
sudo apt-get install wireshark
Now you should allow to pass the traffic through your sniffing device with:
echo 1 > /proc/sys/net/ipv4/ip_forward
After that we would start spoofing the AP device and one of our two machines (We will call it target device). We will open 2 terminals and we will write one of this commands on each terminal window:
arpspoof -i XXX -t YYY ZZZ
arpspoof -i XXX -t ZZZ YYY
Where XXX will be the interface name of our sniffing machine where we will receive the packets. On the other hand, on YYY we will write the target IP and in ZZZ the gateway IP. Once we are done with it, we will have to open wireshark and start sniffing the interface we wrote in command line. Then, we should start seeing packets from the target device to the gateway device.
If you want more information about it you might find it googling for "Men in the middle attack". What I explained here is a Men in the Middle with ARP spoofing. There are other ways of doing it.
Finally, if you want to sniffing link layer and below you could install airbase-ng and start by bringing up the main interface ifconfig wlan0 up and starting a monitor mode interface on channel the channel of your network.
airmon-ng start wlan0 CHANNEL
Where CHANNEL would be a number. After that
airbase-ng -c CHANNEL -e mon0
If we write
iwconfig we will see the new interface mon0. Now install wireshark if you don't have it already installed and by starting up wireshark & and sniffing mon interface, and then, we should see all of the packets or frames going in and out of this card.
Hope it helps.
Go to "Show the capture options".
Find you Wi-Fi adapter and double click it.
The configuration window will show up. Mark
Capture packets in monitor mode. With this option enabled your adapter will capture all Wi-Fi traffic it can hear, not only traffic intended for you.
After that click
OK to save the changes and click
Start in the Capture Options window. You will see all Wi-Fi traffic that gets to you. Adjust the channel (Frequency) to match one that your devices use.
If you debug encrypted Wi-Fi network than you can tell Wireshark the SSID and password of the desired network and it will decrypt packets so that you can inspect them.
Wireshark wiki describes this procedure.
Wireshark can decrypt WEP and WPA/WPA2 in pre-shared (or personal) mode. WPA/WPA2 enterprise mode decryption is not yet supported.
WPA and WPA2 use keys derived from an EAPOL handshake, which occurs when a machine joins a Wi-Fi network, to encrypt traffic. Unless all four handshake packets are present for the session you're trying to decrypt, Wireshark won't be able to decrypt the traffic. You can use the display filter eapol to locate EAPOL packets in your capture.
Make sure you understand this:
The WPA passphrase and SSID preferences let you encode non-printable or otherwise troublesome characters using URI-style percent escapes, e.g. %20 for a space. As a result you have to escape the percent characters themselves using %25.
With this you should be able to monitor Wi-Fi traffic.