4

If I correctly understood the basics of the wireless working, I should be able to sniff the traffic of other computers over the wireless LAN. So I connected a second computer to my wireless LAN and tried to see if I was able to sniff its http traffic through the network, using tcpdump with a command like this:

sudo tcpdump -v -i wlan0 dst 10.0.0.7

while 10.0.0.7 is the ip of the computer that I want to sniff over the LAN. But unfortunately, I get nothing as output (excepted ICMP echo requests if I ping 10.0.0.7, so tcpdump works fine :) ).

What am I missing?

migrated from security.stackexchange.com Jun 26 '15 at 9:08

This question came from our site for information security professionals.

  • what does dst mean to tcpdump? – schroeder Jun 25 '15 at 21:53
  • @schroeder: dst mean that I'm listening only the packets for which the destination field is 10.0.0.7 – Sam Bruns Jun 25 '15 at 22:00
  • right - and how would that be the case from your machine? – schroeder Jun 25 '15 at 22:00
  • @schroeder: I thought I could simply sniff the packet directed from the default gateway to the computer I want to sniff. Because since the packets are transmitted over the wifi, I should be able to hear them although I'm not the recipient. 10.0.0.7 is the ip address of the computer I want to sniff, and 10.0.0.8 is my ip address. – Sam Bruns Jun 25 '15 at 22:03
  • That depends on the type of wifi you are using... It doesn't act like a hub, but a switch. – schroeder Jun 25 '15 at 23:13
9

You will need to set your network interface into monitor mode to be able to sniff all traffic on the wireless network. So, before starting up tcpdump, do the following:

sudo ifconfig wlan0 down
sudo iwconfig wlan0 mode Monitor
sudo ifconfig wlan0 up

This will simply turn off your interface, enable monitor mode and turn it on again. Note that not all network interface cards support monitor mode.

To reset your NIC back to normal, issue the same commands, but with mode Managed .

On a side note, the traffic on your sniffer will most likely not look how you will expect it to look, due to any encryption schemes your router uses. Considering that you are sniffing your own network, you will be able to decrypt the traffic in most cases though. Here is a short overview on how to do it on Wireshark, an alternative to tcpdump that also features a graphical user interface. If you prefer to keep tcpdump for capturing, you can also use its -w option to dump traffic to a .pcap file and later open that file in Wireshark (or any other packet analyzer).

Note that if your network uses WPA or WPA2 encryption, you will need to capture the respective handshakes between router and each device you want to monitor. The Wireshark wiki article I linked explains how to do so:

WPA and WPA2 use keys derived from an EAPOL handshake, which occurs when a machine joins a Wi-Fi network, to encrypt traffic. Unless all four handshake packets are present for the session you're trying to decrypt, Wireshark won't be able to decrypt the traffic. You can use the display filter eapol to locate EAPOL packets in your capture.

In order to capture the handshake for a machine, you will need to force the machine to (re-)join the network while the capture is in progress.

  • @zinfandel: Thanks a lot! I understood now. So if I correctly understood the connection between each computer and the access point is encrypted, while using WPA, or WPA2 encryption? – Sam Bruns Jun 26 '15 at 10:35
  • 1
    Yes, traffic is encrypted on a "protected" network, i.e. one using WEP, WPA, or WPA2. – user164970 Jun 26 '15 at 15:49
  • @zinfandel: Could you explain why i have to choose Monitor mode over Promiscuous mode? Thanks :) – Sam Bruns Jun 28 '15 at 19:24
  • 1
    @SamBruns Monitor mode is WiFi's version of Promiscuous mode. – David Poole Dec 23 '16 at 14:54
2

First off, you didn't specify if this was an open network or WPA protected. That makes a difference. I'll assume it's WPA because you are experiencing problems.

You are not the man in the middle. The packets from 10.0.0.7 are going from that computer directly to the gateway (i.e. 10.0.0.1) and out to the internet, bypassing you. You need to arp spoof and insert yourself between the gateway and that user (10.0.0.7). There are many tools to do that. Typically you first set up ip forwarding in your kernel, then run a command like arpspoof <victim ip> <gateway ip>

  • 1
    First of all: thanks for answering! I see. But I don't manage to understand the need for arp spoofing. Why can't I simply sniff the packet being transmitted over the LAN? Could you explain, or redirect me to some learning material? Thanks! – Sam Bruns Jun 25 '15 at 21:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.