I trying to see Wi-Fi (802.11) packets through Wireshark.
Here's information of my wireless interface:
$ ifconfig wlan1 Link encap:Ethernet HWaddr c0:f8:da:21:ce:68 # and so on blahblah $ iwconfig wlan1 IEEE 802.11abgn ESSID:"myAccessPoint" Mode:Managed Frequency:2.432 GHz Access Point: 00:26:66:C4:80:FC #and so on blahblah
When I execute Wireshark and change mode of
wlan1 to "monitor" in order to use "802.11 plus radiotap header",
iwconfig show different things:
$ ifconfig wlan1 Link encap:UNSPEC HWaddr C0-F8-DA-21-CE-68-00-00-00-00-00-00-00-00-00-00 # and so on blahblah $ iwconfig wlan1 IEEE 802.11abgn Mode:Monitor Frequency:2.432 GHz Tx-Power=16 dBm # and so on blahblah
(I.e., the hardware address has had ten
00 octets appended.
And, oddly enough, it is now shown with capital letters instead of lower case.)
I've injected several null data frames with
aireplay-ng and captured them with Wireshark (EfmNetwo_... is an access point):
I am quite sure that
e0:99:71:57:9b:3a is a MAC address of wireless interface on my machine since content of packets seem to be what I've injected.
The strange thing is, I've never seen such a MAC address in
iwconfig. I think something like virtual interface is generated and that interface has such a MAC address.
Is what I said correct? If so, is there another way to see that MAC address from outside of Wireshark?
If what I said is wrong, could someone explain such a strange MAC address?