2

I am currently digging into WLAN management frames. For this, I wanted to capture management frames using few Linux utilities. So what I did so far is:

  • Put my interface (wlp2s0) in managed mode without being connected to an AP
  • Create monitoring interface: iw dev wlp2s0 interface add mon0 type monitor
  • Bring mon0 up: ifconfig mon0 up
  • Capture all frames on mon0 using wireshark without any filters
  • Trigger active scanning using iwlist wlp2s0 scan

What I get from this is a bunch of Beacon frames and each time I run the scan, I receive probe responses from the APs. But I don't see any probe requests.

What am I missing here?

1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Feb 19 '18 at 19:16
1

Make sure Wireshark promiscuous mode is turned on. It's under capture options in the gui. I'm assuming your using an atheros chip wifi card or something compatible. Also, make sure your not joined to any SSIDs.

I normally don't like links in an answer but we'll call this a bonus. It's a how to with detailed instructions for diffrent distributions of OS's and is extremely long or i I'd post it. wireless monitor mode with Wireshark

1
  • There are online classes and videos for this also. I can't tell you where to buy classes on here but sometimes udemy.com has some free ones.
    – Fixitrod
    Aug 21 '17 at 2:57
0

There could be one of at least two possible things going on here:

1.) You don't have a strong enough signal from your monitor to the client. The AP's antennae are better at listening and sorting out background noise than your PC is. You might need to move closer to the client you're trying to listen to.

2.) Your NIC doesn't support promiscuous mode. There are many out there that are hardcoded to ignore traffic they aren't supposed to interact with or see. The only workaround for this is to purchase a NIC that supports promiscuous mode. You can probably search around for your current NIC model and the term 'promiscuous mode' to see if other people have had similar issues.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.