1

I have been trying to analyze packets using tcpdump. I am trying to use a wireless card and capture packets through monitor mode, instead of promiscuous mode, since I want to see what kind of traffic can an outsider see, without connecting to the network.

  • My card supports monitor mode, and I always put it in monitor mode before capturing.

Now, here is where my problem starts.

  • I noticed that on some channels, I am only able to see broadcast probe requests, and nothing else.
  • If I try using the same adapter on the same channels on Omnipeek though, it captures many more packets, and even packets going to and from my device, not just broadcast.

So, I was wondering :

  • why Omnipeek was able to capture many more packets in comparison to tcpdump ?
  • It could not be a card related issue because the same card can capture on omnipeek but not on tcpdump.
  • So, why does this happen ?

I have tried looking up various things but I could not find any resources. I will be glad to receive any kind of direction, does not have to be the full solution.

Note: I tried capturing through airmong, and it showed me many more packets as well, but I am trying to capture only through tcpdump, so I am curious. Also, I am not able to share any output, since the capture is being done on two different machines

4
  • Edited to remove home networking reference.
    – Ron Trunk
    Jul 16, 2020 at 12:44
  • Have you tried including the -n option? DNS may be slowing you down.
    – Ron Trunk
    Jul 16, 2020 at 12:48
  • Yes I did. Does not make a difference.
    – DJay
    Jul 16, 2020 at 15:37
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Dec 16, 2020 at 23:23

1 Answer 1

0

It looks like both monitor and promiscuous modes of tcpdump should get you a lot of traffic:

https://en.wikipedia.org/wiki/Monitor_mode#:~:text=Monitor%20mode%2C%20or%20RFMON%20(Radio,received%20on%20a%20wireless%20channel.&text=Monitor%20mode%20only%20applies%20to,both%20wired%20and%20wireless%20networks.

https://en.wikipedia.org/wiki/Promiscuous_mode

If you are seeing more traffic with Omnipeek must something from this list:

  1. scanning multiple channels
  2. running in promiscuous mode
  3. providing an OS level driver that can capture the raw packets

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.