WiFi traffic

gustavolinux · 11-18-2008, 07:31 AM

Folks, how do I do to capture all the traffic that my wifi interface is able to get? There is a mode called raw monitor, right? How do I do to turn this mode 'on'? I have a DLINK wifi interface, and I don't know if it support this mode... How can I discover this?

The only attempt I made was to lauch wireshark and select the wifi interface... nothing was captured... But my PC was able to discover several networks surrounding me... What means that some packets (broadcast SSID) where captured, right? Why wireshark didn`t displayed them? (I selected promiscuos mode in the wireshark menu)...

thanx you all!

angel115 · 11-18-2008, 07:53 AM

Did you put your Wireless card in promiscuous mode?

Code:

iwconfig wlan0 promisc
airodump wlan0 capture.pcap 0

iwconfig wlan0 promisc = will turn the promiscuous mode ON on the interface wlan0

airodump wlan0 capture.pcap 0 = will capture every thing with pass throught the interface wlan0 on all chanel and put it in the capture.pcap file.

If I didn't done any mistake this should work.

Angel.

kapal · 11-18-2008, 09:08 AM

I guess you meant:

Code:

iwconfig wlan0 mode monitor

because in my case

Code:

iwconfig wlan0 promisc

yeilds

Code:

iwconfig: unknown command "promisc"

Quote:

Originally Posted by angel115

(...)

Code:

iwconfig wlan0 promisc
airodump wlan0 capture.pcap 0

(...)

angel115 · 11-19-2008, 02:22 AM

Yes, sorry.

mickyg · 11-19-2008, 07:12 AM

Off the top of my head I think you can use iwpriv to find out what functions your wifi card supports, or rather, what functions the driver you're using supports.