2

I am new to networking; so far we learned about the OSI model, packaging stuff, Wireshark, and network troubleshooting. As I have had understood, Wireshark is able to capture all packets by going to promiscuous mode.

But when I go to promiscuous or monitor mode I will be disconnected from my router and can't see any traffic except DHCP and such stuff. No relevant TCP, UDP,... stuff.

I think of course it's because if someone is not associated to my router he should not be able to see my traffic but what is the promiscuous mode for? When I am not associated to my access point, what's the sense of capturing?

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 12 '17 at 4:17
3

But when i go to promiscous or monitor mode i will be disconnected from my router and cant see any traffic except dhcp and such stuff. but no relevant tcp, udp,.. stuff.

For promiscuous mode, which is mainly a wired-network feature (it doesn't work well on Wi-Fi adapters), you won't be "disconnected" in the sense that you will no longer be connected to the network. However, Ethernet doesn't generally work the way it originally did, and promiscuous mode doesn't work as well as it used to. Promiscuous mode is a mode your network adapter works in, in which it hands packets to the host no matter what the destination MAC address, but if the switch won't even send you the packets that aren't broadcast or multicast or addressed to you, there's nothing your adapter can do.

For monitor mode, which is a Wi-Fi feature (it doesn't exist on wired adapters), whether you are "disconnected" in monitor mode, in the sense that you will no longer be connected to the network, depends on your network adapter, OS, and driver. Wi-Fi networks are on a shared medium, unlike switched Ethernet networks, so you'll be able to capture all the packets; however, most Wi-Fi networks are "protected", using WEP or WPA/WPA2, meaning the traffic is encrypted, and you'll need a tool that can decrypt that traffic (such as Wireshark) and the password for the network and, for modern networks using WPA or WPA2, the initial connecting-to-the-network handshake for each device whose traffic you want to decrypt.

Your problem sounds like "can see only broadcast traffic" (such as broadcast DHCP requests), so you're probably on a switched Ethernet, and will have to use one of the techniques mentioned in the Wireshark Wiki's page on Ethernet capturing.

However, you later refer to being associated with the network, which sounds like Wi-Fi. In that case, promiscuous mode won't help; you'll need monitor mode and all the stuff necessary for decrypting traffic.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.