0

enter image description hereSee below link that I was unable to comment. Sorry for the dupe but I have tried hard to get a satisfactory answer to this question. Upon reading the WS docs and others, I am led to believe that I can capture packets from multiple hosts (on the same AP) if my USB wireless card is in monitor mode and I have the wpa key to the Ap. That is all I'm trying to do, No hacking, just capturing packets similar to what I would get with port mirroring on a switch. Is this not true? Similar to question in the link below, I have a card in monitor mode and the wpa key, but all I get is 802.11 broadcast traffic. Is that it? Do I need to authenticate to the AP to get the traffic ONLY from my card (similar to LAN Config?) or am I missing something?

https://sqa.stackexchange.com/questions/25398/how-to-read-the-encrypted-payload-where-the-http-data-would-be-located?noredirect=1&lq=1&newreg=601b0a277e434a828da5d8512b6135fd

Improve this question
3
  • 3
    If all you see are broadcasts then you aren’t in monitor mode or your driver doesn’t support it. Or there are no clients.
    – Ron Trunk
    May 21, 2019 at 15:25
  • 1
    Please, never use an image for text. Simply copy the text and paste it into the question using the Prefomatted-text option ({}).
    – Ron Maupin ♦
    May 22, 2019 at 14:39
  • Thx for the responses. Yeah, all seems to be good with the card. (see updated image) and I'm finally able to capture some tcp data by verifying the eapol protocol gets 1,2,3 & 4 of the authentication handshake. Apparently, this was the piece that I was missing. I assume that I'm only getting some of the network data because the card (brand new) only supports 2.4GHz and a lot fo the network runs on 5GHZ. I'm could be wrong but I'll bang my head some more to see.
    – PidePython
    May 22, 2019 at 14:43

1 Answer 1

Reset to default
4

Just looked at this chipset and it is really a 2.4GHz 802.11n 1x1:1 chipset (with some features to possibly improve the Rx performance).

This means you won't get any 5GHz traffic (including 802.11n 5GHz and all 802.11ac traffic), and likely won't be able to capture much of the 802.11n 2.4GHz traffic (i.e. any traffic using more than one spatial stream will be lost). Specifically, only HT MCS data rates from 0-7 will likely be available to the chipset, while 8-15 (common - in my experience most of 802.11n traffic in 2.4GHz) and 16-23/24-31 (not common) will not.

Improve this answer
2
  • Appreciate your insight and have order another usb to see if that fixes this. (Alfa Long-Range Dual-Band AC1200 Wireless USB 3.0 Wi-Fi Adapter w/2x 5dBi External Antennas – 2.4GHz 300Mbps/5GHz 867Mbps – 802.11ac & A, B, G, N). It is almost funny that sniffing packets on Wifi is billed to be such an easy thing to do but I've spent 2 weeks with 4 usb cards trying to get it to work. Really grateful that you guys are here.
    – PidePython
    May 24, 2019 at 13:19
  • I installed the new 5Ghz USB and it is way better! thnx. One last Q: I disconnect/reconnect a mac or pc to get the EAPOL packets to decrypt. I notice that the machine from which I capture the auth prot gives me more detailed traffic. Do i need to get the auth prot from ALL machines on the wifi net? For example, I have a test server on Linode - when the device that provided the auth prot, on my wifi, pings it ...it is captured in wireshark. Not so for any other device.
    – PidePython
    May 29, 2019 at 14:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.