4

I'm on a MacBook air, and I got a book form the library about wireless network security. I've been following pretty diligently, but it seems like no matter what I do I cannot capture packets of other devices on my network.

I've tried using WireShark, with the "promiscuous" box checked, on my en0 interface. (en0 is the only internet interface on a macbook air, the other options being loopback, and peer to peer).

I've added the wireless SSID and password to wireshark, and applied that change, I also tried disconnecting and reconnecting my iPhone to the network several times, hoping to pick up the traffic from there.

The last try: I used the raw tcpdump command as root, with and without the -p flag (without -p means run in promiscuous mode), and then analyzed the packets from the pcap file, which there were plenty of, just not any from any other machines.

Clearly there is something I am missing, maybe some kind of internal configuration deal. I would really appreciate help on this, it would make a great demo for job interviews, and would be an awesome skill to have.

Improve this question
3
  • What you're looking for is "radio monitor mode". The drivers found in many OSes do not support it. (esp. in windows) There may be ways to get a Mac into the correct mode, but the wireless hardware has to support it. (as we found with thinkpads, they just won't do it.)
    – Ricky
    Aug 16, 2013 at 2:21
  • 1
    The drivers of Wireless card should support monitor mode. An OS pre-loaded with such drivers and wide used solution is Linux Backtrack. Why you don't try a live version of Backtrack ? I can get you the command to enable it. By the way, normally in Windows you should buy a specific Wireless USB Dongle Like bit.ly/12UFG4Z
    – cgasp
    Aug 16, 2013 at 5:05
  • Could you specify how is built your wireless network on which your MacBook Air and your iPhone are connecting? Is it built from a router, from a Mac running Internet Sharing, from another OS running an access point on its wireless interface?
    – dan
    Mar 9, 2015 at 10:06

5 Answers 5

Reset to default
6

I've tried using WireShark, with the "promiscuous" box checked, on my en0 interface.

You say "en0", so you're running OS X (rather than, for example, Linux), so the "monitor mode" checkbox should work, and you're on a MacBook Air, so that's your AirPort interface, i.e. it's an 802.11 interface. "Promiscuous" mode doesn't necessarily work the way you'd want on 802.11 interfaces, so you need "monitor" mode.

Try checking the monitor mode checkbox, but note that, in monitor mode, traffic won't be decrypted if you're on a "protected" (WEP or WPA/WPA2) network; see the Wireshark Wiki "How to decrypt 802.11" page for details on how to decrypt the traffic.

If you want to use a command-line tool such as tcpdump or TShark, use the -I command-line flag to turn monitor mode on.

Improve this answer
4
  • So if an 802.11 interface doesn't work the way I want it to, what interface will allow me to achieve the desired results? I only ask because I don't really want traffic from a billion wifi networks if I'm just looking for one signal.
    – OneChillDude
    Aug 16, 2013 at 21:46
  • "So if an 802.11 interface doesn't work the way I want it to" I didn't say the interface won't work the way you want, I said promiscuous mode won't work the way you want - it won't actually be "promiscuous" in the sense of capturing traffic to or from other machines. If you want to capture Wi-Fi traffic, that's 802.11 traffic, so you need an 802.11 interface, and you need monitor mode, with all its limitations. You'd have to use a capture filter if you want to limit the traffic you see.
    – user2373
    Aug 17, 2013 at 1:24
  • Is there a way I can limit monitor mode to just traffic on my network, and then decrypt the 802.11 frames from there?
    – OneChillDude
    Aug 17, 2013 at 2:31
  • Not at the radio layer, so you can't change the way monitor mode behaves; you'd need a capture filter. You can't do that for control frames, but for management and data frames, try using a capture filter specifying that one of: the source address, destination address, receiver address, or the transmitter address must be the MAC address of your access point.
    – user2373
    Aug 17, 2013 at 6:46
1

After you enable promiscuous mode in wireshark, don't forget to run wireshark with sudo. When you run wireshark without sudo, it runs no problem but only shows you packets from/to your computer. To see packets from other computers, you need to run with sudo.

Confirmed with Wireshark 2.0.1 on MacOSX 10.11.5 today.

Improve this answer
0

I have the same issue as you while running Kali Linux on my 2009 Macbook Pro. However, I can see the rest of the traffic on my network if plug directly into my router and use the ethernet connection rather than wlan0 (en0 for OSX) as my interface for Wireshark.

There are options out there for ethernet to USB adaptors for the Macbook air. Much less stealthy, but it may do the trick :)

Improve this answer
0

If you own the device you want to sniff (and if you don't, maybe you shouldn't do it) then there is the option of creating a wifi hotspot on your mac and connect your mobile device to the hotspot. This lets you see all the traffic going thru your mac without any wifi-related encryption. Of course, ssl encryption remains.

You need to be otherwise connected by ethernet.

Improve this answer
0

Before running any trafic analysis tool, just run a basic in Terminal window 1:

ifconfig en0

to get the default configuration of your Wi-Fi interface.

Then in another Terminal window 2 start a:

/usr/bin/sudo tcpdump -i en0

Back in Terminal window 1, run once more:

ifconfig en0

and you should see that now your Wi-Fi interface is in promiscuous mode (PROMISC flag):

en0: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
    ether zz:yy:xx:ww:vv:uu 
    inet 192.168.2.2 netmask 0xffffff00 broadcast 192.168.2.255
    media: autoselect
    status: active

If your version of MacOS X doesn't behave exactly as this, please add the output of the above basic test within your OQ, and specify which version of MacOS X you are running.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.