Sniffing packet on wireless connection (airodump-ng)

Question

Short Question:

Is it important for a sniffing device to be in the broadcasting range of a client (NOT THE ROUTER) to sniff its packets?

Complete Scenario:

I assume that a wireless sniffing tool, like airodump-ng, is able to capture the packets from a client because the client sends its packets in all the directions in a wireless connection (unlike a wired connection where the packets travel through the wire in a certain direction).

Now, let's say we have a router A with a broadcasting range of 50m radius. 20m east of it is a client, B, connected to it. B has a range of 25m. And the sniffing device, say C, is placed 20m to the west of A. Is it, anyhow, possible for C to sniff B's packets?

Answer 1

Yes.

It's possible, it will be shown in the list of detected stations, and if it's connected to an AP, the AP can be shown in the AP list, but with little information it's gathered from the packets sent from the client to the AP.

Give it a try and see it for yourself.

wireshark output.cap

or .pcap, or .ivs file.

EDIT (This is a NO)

I misread the question, as @thomas-weller said, A (The AP) doesn't re-transmit packets of B. I thought the monitor antenna (B was it?) was in range of the client (c?)

Answer 2

No, it is not important, here's how it works:

When you're scanning a wireless network, you first find the BSSID (The AP), listen to it specifically until a client connects. I assume you know the basics.

When you use aireplay-ng to disconnect, your sniffing device sends it to the AP, which in turns sends it to the station. That's why there are two different pairs of ACK 4/60 appearing in the following screenshot:

Conclusion: What's important is to be as closer as possible to the AP you're trying to disconnect. The AP gives you all the information you need as it is directly connected to the client.

Btw: You can also just disconnect all of them by sending the deauth packets to the AP, but that's not something you wanna do on most pentest engagements.