Does tcpdump work differently from Omnipeek?

Question

I have been trying to analyze packets using tcpdump. I am trying to use a wireless card and capture packets through monitor mode, instead of promiscuous mode, since I want to see what kind of traffic can an outsider see, without connecting to the network.

• My card supports monitor mode, and I always put it in monitor mode before capturing.

Now, here is where my problem starts.

• I noticed that on some channels, I am only able to see broadcast probe requests, and nothing else.
• If I try using the same adapter on the same channels on Omnipeek though, it captures many more packets, and even packets going to and from my device, not just broadcast.

So, I was wondering :

• why Omnipeek was able to capture many more packets in comparison to tcpdump ?
• It could not be a card related issue because the same card can capture on omnipeek but not on tcpdump.
• So, why does this happen ?

I have tried looking up various things but I could not find any resources. I will be glad to receive any kind of direction, does not have to be the full solution.

Note: I tried capturing through airmong, and it showed me many more packets as well, but I am trying to capture only through tcpdump, so I am curious. Also, I am not able to share any output, since the capture is being done on two different machines

Answer 1

It looks like both monitor and promiscuous modes of tcpdump should get you a lot of traffic:

https://en.wikipedia.org/wiki/Monitor_mode#:~:text=Monitor%20mode%2C%20or%20RFMON%20(Radio,received%20on%20a%20wireless%20channel.&text=Monitor%20mode%20only%20applies%20to,both%20wired%20and%20wireless%20networks.

https://en.wikipedia.org/wiki/Promiscuous_mode

If you are seeing more traffic with Omnipeek must something from this list:

1. scanning multiple channels
2. running in promiscuous mode
3. providing an OS level driver that can capture the raw packets