I am trying to sniff traffic coming from or going to a smartphone on the local WiFi network (in a legal way). For that purpose I use the command TCPDump on a computer connected to the same wireless network.

My goal is to detect when smartphones connects to the wifi access point. I can detect iPhones because they use mDNS to advertise its presence. I can sniff packets from iPhone 5 et 5S, from a Galaxy phone with Android 5, but not from a Galaxy with Android 4.4.2.

With this device (GS3 Android 4.4.2) I can only sniff ICMP traffic, which is what is used for ping request. Instead of that I have nothing.

How can this be possible ? What can I do to sniff packets as I do with iPhones ? Does not Android use broadcasted messages for establishing a communication with an access point ?

Thank you.

  • Perhaps your AP has isolation enabled, which means clients can't see each other. Use a router that's supported by openwrt and put that on the router. Then you can install and use tcpdump on the router itself.
    – wurtel
    Jul 10, 2015 at 13:19
  • Thank you for your response. I think the AP is fine, because I can ping everything, see everything and I have some network tools that work perfectly and show me everything on the .local.
    – phenetas
    Jul 10, 2015 at 18:56


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.