If I start capturing on an interface (e.g. wlan0) with Wireshark while it's down, and then bring the interface up, Wireshark stops the capture and I have to restart it. This way I can't see packets that were sent between pulling up the interface and clicking on "start capture" in Wireshark. Is there a way to catch those packets too?
1 Answer
If you can afford to change the operating system in the client.Then I have a solution which might just work for your scenario.
Capture the packets using TCPDUMP
Option 1: Execute the commands in one shot--> if down; If up;tcpdump -i wlan0 -w cap.pcap
Option 2: Create a small script to capture the packets and places it in if-up.d
A small version like below should do the job.
/etc/network/if-up.d
#!/bin/bash
tcpdump -s0 -i wlan0 -C 50 -w /path/to/ capture-$(date +%a-%d%m%y-%H%M-%S).pcap
This script will be invoked when the interface is up and your packets will be available in the required path with timestamp.Later on,You can open the pcap in wireshark and look for your data flow
Hope this will help you.
