I'm trying to determine the cause of a communication problem between two devices on my wifi network. I CANNOT install programs on them to determine this.

How can I monitor the traffic between these two devices?

  • If the wireless access point is using encryption you can't.
    – Ramhound
    Jun 2 '15 at 11:35
  • Does that mean if I turn off password protection on the network I can?
    – PopKernel
    Jun 2 '15 at 11:36
  • If these devices were connected to a insecure wireless access point you could sniff any traffic that wasn't encrypted ( i.e. non-https traffic ).
    – Ramhound
    Jun 2 '15 at 11:38
  • You can inspect encrypted Wi-Fi traffic (WPA2 personal), considering you know the SSID and password.
    – VL-80
    Jun 4 '15 at 13:52

First of all, we should know to what kind of packets do we have to sniff. The following explanation supposes that you are interested in sniffing transport layer and above. Furthermore, I also suppose that you have the typical network structure in which you have an AP, which is in the middle of the communication of the two devices.

If you have other Linux OS machine available in which you can install programs it would be possible. Supposing that you already are inside the network with this 3rd machine (Sniffer), you should install arpspoofing and wireshark:

sudo apt-get install arpspoof

sudo apt-get install wireshark

Now you should allow to pass the traffic through your sniffing device with:

echo 1 > /proc/sys/net/ipv4/ip_forward

After that we would start spoofing the AP device and one of our two machines (We will call it target device). We will open 2 terminals and we will write one of this commands on each terminal window:

arpspoof -i XXX -t YYY ZZZ

arpspoof -i XXX -t ZZZ YYY

Where XXX will be the interface name of our sniffing machine where we will receive the packets. On the other hand, on YYY we will write the target IP and in ZZZ the gateway IP. Once we are done with it, we will have to open wireshark and start sniffing the interface we wrote in command line. Then, we should start seeing packets from the target device to the gateway device.

If you want more information about it you might find it googling for "Men in the middle attack". What I explained here is a Men in the Middle with ARP spoofing. There are other ways of doing it.

Finally, if you want to sniffing link layer and below you could install airbase-ng and start by bringing up the main interface ifconfig wlan0 up and starting a monitor mode interface on channel the channel of your network.

airmon-ng start wlan0 CHANNEL

Where CHANNEL would be a number. After that

airbase-ng -c CHANNEL -e mon0

If we write iwconfig we will see the new interface mon0. Now install wireshark if you don't have it already installed and by starting up wireshark & and sniffing mon interface, and then, we should see all of the packets or frames going in and out of this card.

Hope it helps.


Use Wireshark.

Go to "Show the capture options". Menu

Find you Wi-Fi adapter and double click it. Capture Options

The configuration window will show up. Mark Capture packets in monitor mode. With this option enabled your adapter will capture all Wi-Fi traffic it can hear, not only traffic intended for you. Interface settings

After that click OK to save the changes and click Start in the Capture Options window. You will see all Wi-Fi traffic that gets to you. Adjust the channel (Frequency) to match one that your devices use. Frequency config

Encrypted network

If you debug encrypted Wi-Fi network than you can tell Wireshark the SSID and password of the desired network and it will decrypt packets so that you can inspect them.

Wireshark wiki describes this procedure.

Wireshark can decrypt WEP and WPA/WPA2 in pre-shared (or personal) mode. WPA/WPA2 enterprise mode decryption is not yet supported.

In short:

  1. Go to Edit->Preferences->Protocols->IEEE 802.11.
  2. Add SSID and password in form of wpa-pwd:MyPassword:MySSID

WPA and WPA2 use keys derived from an EAPOL handshake, which occurs when a machine joins a Wi-Fi network, to encrypt traffic. Unless all four handshake packets are present for the session you're trying to decrypt, Wireshark won't be able to decrypt the traffic. You can use the display filter eapol to locate EAPOL packets in your capture.

Make sure you understand this:

The WPA passphrase and SSID preferences let you encode non-printable or otherwise troublesome characters using URI-style percent escapes, e.g. %20 for a space. As a result you have to escape the percent characters themselves using %25.

With this you should be able to monitor Wi-Fi traffic.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.