If I start capturing on an interface (e.g. wlan0) with Wireshark while it's down, and then bring the interface up, Wireshark stops the capture and I have to restart it. This way I can't see packets that were sent between pulling up the interface and clicking on "start capture" in Wireshark. Is there a way to catch those packets too?

1 Answer 1


If you can afford to change the operating system in the client.Then I have a solution which might just work for your scenario.

Capture the packets using TCPDUMP

Option 1: Execute the commands in one shot--> if down; If up;tcpdump -i wlan0 -w cap.pcap

Option 2: Create a small script to capture the packets and places it in if-up.d

A small version like below should do the job.



tcpdump -s0 -i wlan0 -C 50 -w /path/to/ capture-$(date +%a-%d%m%y-%H%M-%S).pcap

This script will be invoked when the interface is up and your packets will be available in the required path with timestamp.Later on,You can open the pcap in wireshark and look for your data flow

Hope this will help you.

  • Thanks, the second option worked but I don't get the first one, could you say how that works exactly?
    – Nesa
    Commented Apr 10, 2018 at 15:25
  • I'm happy I could help you.If you feel any of the solution I have provided worked for you then choose the tick and accept the answer.
    – Maverick
    Commented Apr 10, 2018 at 15:26
  • In Option 1 If down and If up means "ifconfig interface down/up".
    – Nesa
    Commented Apr 14, 2018 at 14:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.