If I start capturing on an interface (e.g. wlan0) with Wireshark while it's down, and then bring the interface up, Wireshark stops the capture and I have to restart it. This way I can't see packets that were sent between pulling up the interface and clicking on "start capture" in Wireshark. Is there a way to catch those packets too?


If you can afford to change the operating system in the client.Then I have a solution which might just work for your scenario.

Capture the packets using TCPDUMP

Option 1: Execute the commands in one shot--> if down; If up;tcpdump -i wlan0 -w cap.pcap

Option 2: Create a small script to capture the packets and places it in if-up.d

A small version like below should do the job.



tcpdump -s0 -i wlan0 -C 50 -w /path/to/ capture-$(date +%a-%d%m%y-%H%M-%S).pcap

This script will be invoked when the interface is up and your packets will be available in the required path with timestamp.Later on,You can open the pcap in wireshark and look for your data flow

Hope this will help you.

  • Thanks, the second option worked but I don't get the first one, could you say how that works exactly? – Nesa Apr 10 '18 at 15:25
  • I'm happy I could help you.If you feel any of the solution I have provided worked for you then choose the tick and accept the answer. – Maverick Apr 10 '18 at 15:26
  • In Option 1 If down and If up means "ifconfig interface down/up". – Nesa Apr 14 '18 at 14:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.