I am using an embedded Wi-Fi module (ESP8266) to act as a logger to find devices that are using my LAN network. I can get this module to sniff Wi-Fi packets promiscuously, but now I need to decode the raw packets so that I know the IP and MAC address from devices in my network.

I want to make sure that these packets do contain IP and MAC addresses.

I also attached the hex dump log here:

promiscuous sniff 1 enter image description here

My question is: is there any method to decode these hex values to get the MAC and IP addresses of devices in the network? I tried to use Wireshark -> Import Hex Dump -> use encapsulation type ranging from Ethernet, 802.11 Wireless LAN, 802.11 Wireless LAN with radio information but it returns empty.

  • You tried to use Wireshark and? – Rsf Mar 15 '17 at 17:30
  • I rephrase the question – bonchenko Jul 19 '17 at 14:06

Typically, your Wi-Fi frame payload will be encrypted, and we cannot/will not help you decode the encryption. The MAC addresses will be in the unencrypted frame headers. The first six octets of the frame headers should be the destination address, and the next six octets should be the source MAC address.

There is software that will help you see this better, but recommendations are off-topic here. Wireshark needs its data in a specific format (PCAP).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.