If I correctly understood the basics of the wireless working, I should be able to sniff the traffic of other computers over the wireless LAN. So I connected a second computer to my wireless LAN and tried to see if I was able to sniff its http traffic through the network, using tcpdump with a command like this:

sudo tcpdump -v -i wlan0 dst

while is the ip of the computer that I want to sniff over the LAN. But unfortunately, I get nothing as output (excepted ICMP echo requests if I ping, so tcpdump works fine :) ).

What am I missing?

  • what does dst mean to tcpdump?
    – schroeder
    Jun 25, 2015 at 21:53
  • @schroeder: dst mean that I'm listening only the packets for which the destination field is
    – aldeb
    Jun 25, 2015 at 22:00
  • right - and how would that be the case from your machine?
    – schroeder
    Jun 25, 2015 at 22:00
  • @schroeder: I thought I could simply sniff the packet directed from the default gateway to the computer I want to sniff. Because since the packets are transmitted over the wifi, I should be able to hear them although I'm not the recipient. is the ip address of the computer I want to sniff, and is my ip address.
    – aldeb
    Jun 25, 2015 at 22:03
  • That depends on the type of wifi you are using... It doesn't act like a hub, but a switch.
    – schroeder
    Jun 25, 2015 at 23:13

2 Answers 2


You will need to set your network interface into monitor mode to be able to sniff all traffic on the wireless network. So, before starting up tcpdump, do the following:

sudo ifconfig wlan0 down
sudo iwconfig wlan0 mode Monitor
sudo ifconfig wlan0 up

This will simply turn off your interface, enable monitor mode and turn it on again. Note that not all network interface cards support monitor mode.

To reset your NIC back to normal, issue the same commands, but with mode Managed .

On a side note, the traffic on your sniffer will most likely not look how you will expect it to look, due to any encryption schemes your router uses. Considering that you are sniffing your own network, you will be able to decrypt the traffic in most cases though. Here is a short overview on how to do it on Wireshark, an alternative to tcpdump that also features a graphical user interface. If you prefer to keep tcpdump for capturing, you can also use its -w option to dump traffic to a .pcap file and later open that file in Wireshark (or any other packet analyzer).

Note that if your network uses WPA or WPA2 encryption, you will need to capture the respective handshakes between router and each device you want to monitor. The Wireshark wiki article I linked explains how to do so:

WPA and WPA2 use keys derived from an EAPOL handshake, which occurs when a machine joins a Wi-Fi network, to encrypt traffic. Unless all four handshake packets are present for the session you're trying to decrypt, Wireshark won't be able to decrypt the traffic. You can use the display filter eapol to locate EAPOL packets in your capture.

In order to capture the handshake for a machine, you will need to force the machine to (re-)join the network while the capture is in progress.

  • @zinfandel: Thanks a lot! I understood now. So if I correctly understood the connection between each computer and the access point is encrypted, while using WPA, or WPA2 encryption?
    – aldeb
    Jun 26, 2015 at 10:35
  • 1
    Yes, traffic is encrypted on a "protected" network, i.e. one using WEP, WPA, or WPA2.
    – user164970
    Jun 26, 2015 at 15:49
  • @zinfandel: Could you explain why i have to choose Monitor mode over Promiscuous mode? Thanks :)
    – aldeb
    Jun 28, 2015 at 19:24
  • 1
    @SamBruns Monitor mode is WiFi's version of Promiscuous mode. Dec 23, 2016 at 14:54

First off, you didn't specify if this was an open network or WPA protected. That makes a difference. I'll assume it's WPA because you are experiencing problems.

You are not the man in the middle. The packets from are going from that computer directly to the gateway (i.e. and out to the internet, bypassing you. You need to arp spoof and insert yourself between the gateway and that user ( There are many tools to do that. Typically you first set up ip forwarding in your kernel, then run a command like arpspoof <victim ip> <gateway ip>

  • 1
    First of all: thanks for answering! I see. But I don't manage to understand the need for arp spoofing. Why can't I simply sniff the packet being transmitted over the LAN? Could you explain, or redirect me to some learning material? Thanks!
    – aldeb
    Jun 25, 2015 at 21:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .