I have been trying to analyze packets using tcpdump. I am trying to use a wireless card and capture packets through monitor mode, instead of promiscuous mode, since I want to see what kind of traffic can an outsider see, without connecting to the network.
- My card supports monitor mode, and I always put it in monitor mode before capturing.
Now, here is where my problem starts.
- I noticed that on some channels, I am only able to see broadcast probe requests, and nothing else.
- If I try using the same adapter on the same channels on Omnipeek though, it captures many more packets, and even packets going to and from my device, not just broadcast.
So, I was wondering :
- why Omnipeek was able to capture many more packets in comparison to tcpdump ?
- It could not be a card related issue because the same card can capture on omnipeek but not on tcpdump.
- So, why does this happen ?
I have tried looking up various things but I could not find any resources. I will be glad to receive any kind of direction, does not have to be the full solution.
Note: I tried capturing through airmong, and it showed me many more packets as well, but I am trying to capture only through tcpdump, so I am curious. Also, I am not able to share any output, since the capture is being done on two different machines
-n
option? DNS may be slowing you down.