2

I have one doubt about the speed of packets capture in monitor mode. If i have a 300mbps usb wifi adapter in monitor mode, what is the max speed of packet capture?

The 300mbps of my adapter is associated with the 802.11n network, if i connect in 802.11g network, the speed gonna be lower, but in monitor mode, how this works!?

I have a idea that isn't related to Mbps but to pps (packets per second). Just want to clear things in my mind.

6
  • Hi Diego, this is an interesting question, but unfortunately this is the wrong forum for questions like this. You might have better luck on Superuser (superuser.com)
    – Ron Trunk
    Feb 18 '14 at 20:48
  • Hmmm ok, thanks. Created there the same question there. Feb 18 '14 at 23:54
  • @DiegoBernardes, personally, I disagree with Ron's assessment, but cross posting is definitely frowned upon. You should never cross post unless the question is put on hold on the previous site.
    – YLearn
    Feb 18 '14 at 23:58
  • OK, I've gotten this wrong too many times. I'll stop making these kinds of judgements. I'll leave it to others with more experience.
    – Ron Trunk
    Feb 19 '14 at 0:07
  • @Ron Don't be discouraged, NE is still in the 'learning' phase, as it's still pretty young (i.e. < 1 Year). Most of the site's foundation is still being laid, presumably by us. I have danced around the close button on this post, but wireless is certainly a NE subject (even though the OP sounds consumer grade).
    – Ryan Foley
    Feb 19 '14 at 8:20
5

When you are using a wifi adapter in monitor mode, you are not associated to an access point. It will simply listen on the configured channel(s) and capture any traffic it understands whether that is 802.11b, 802.11g, or 802.11n.

If you are associated to an access point, then you are running in promiscuous mode, and then you are generally only going to capture traffic to/from your station plus any broadcast/multicast/management frames.

Now the flip side is that you need to be fairly close to the source of any traffic running at 300Mbps to be able to capture it. The further you get away from the source, the slower the data rate of any usable data you will capture.

This is one of the "tricks" in analyzing any wireless data and when using wireless tools. You need to understand that the data is presented as it is seen from the current location at the current time. I have used tools that indicate there were hundreds of 802.11b clients around me, but that is because the software tool was only capturing traffic from those clients when they were transmitting at 1/2Mbps and not at higher speeds due to distance/obstructions/interference/noise.

2
  • The main idea isn't about capture a single source at 300mbps. Imagine if you turn on a sniffer inside a mall. It can capture thousands of packets per second, what is the limit of capture? The hypothetical limit of 300mbps from your adapter or maybe more? This is the question. Feb 18 '14 at 23:52
  • @DiegoBernardes, RF is a shared medium. No matter how many clients you have in an area, you can only have one usable transmission at a time. This is why wifi uses CSMA/CA. If two devices are next to your capture device and both transmit at the same time, the signal would not be usable. So unless the capabilities of the network/client exceed your capture devices (i.e. they are capable of speeds up to 450/600Mbps), you will capture all usable data that can be heard from that single location.
    – YLearn
    Feb 18 '14 at 23:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.