Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I want to use my computer to capture packets sent by my Android phone in applications: e.g. YouTube.

I captured http requests coming from the machine where Wireshark is installed already, now I want to capture the packets of the Android device that's on my network to verify the security of transmission of some apps.

I'm a beginner, so keep that in mind :)

Specifications:

Network: Uses WPA2 encryption.

Wireshark on physical PC: Linux Mint Debian Edition (LAN: 192.168.1.2 Static) (DNS: DNSCrypt)

Wireshark on Virtual Machine: Kali Linux (couldn't use promiscuous mode on Virtual Machine) (DNS: DNSCrypt)

Android (target): (LAN: 192.168.1.3 Static)

How can I capture the Android packets and filter them in Wireshark?

UPDATE:

It doesn't necessarily have to be using my computer, it's just the preferred way since Wireshark GUI is available on Linux but not on Android. I just had an idea of capturing packets on the Android itself and analyzing it on Wireshark. So the end result needs to be analyzing the packets sent and received by the Android phone.

UPDATE:

Hint: I've worked around the problem already, I used packets capturing tool on Android (WIFIInspect) and analyzed that in Wireshark (first Analysis, awesome!)

Question goes on regardless of my workaround as I need this in the future as well. Help still needed!

I've noticed answers about setting decryption in Wireshark (thanks all!), so I thought to disable network encryption completely to isolate whether this was the problem; It's NOT. I was physically unable to capture packets from my Android device, but I saw SSDP coming from the LAN IP of the Android device. I loaded unencrypted data in the Chrome browser on Android over Open Network, and still couldn't capture the HTTP request. So my question stands, can I capture third-party device using Wireshark over my network?

share|improve this question

4 Answers 4

As you are using WiFi, things are really dead simple (which wouldn't have been the case if you were on a wired network):

  • Launch Wireshark on your computer
  • Set WPA key in Wireshark's settings
  • Run the packet capture on your wireless interface
  • Do whatever you want on your Android device to generate traffic
  • See your wireless traffic unencrypted in Wireshark
  • Enjoy!

With the WPA keys set in Wireshark, it will decrypt packets on-the-fly, allowing you to view your Android device's traffic.

share|improve this answer
    
I've just experimented with this for about an hour trying to get it to work, but hey, nothing as magical as this would've been should just work! Complaining aside, I have WPA2-PSK + AES encryption key set on my network, I tried using wpa-pwd setting with [WiFi key] and failed, tried wpa-psk [WiFi Key + SSID = Generated PSK] and yet still failed, tried various formatting options in inputting those aforementioned trials such as [key:SSID] and [wpa-psk:key:SSID] and failed. I read the documentation you provided and tons more on Google. So thank you for the heads up, never knew this exists –  Mars Jul 21 at 3:00

well, it wouldn't be the easiest (or best idea) to capture traffic directly from your computer or android device. when i want to do this type of things, i fire up ssh to my wireless router and do tcpdump -i br0 so that i could capture traffic from EVERY single device that's accessing the internet through my router. if you could ssh into your wifi router and have tcpdump in your router's busybox (or any other embedded linux) then you're ready to go. just do the command above.

share|improve this answer
    
So I understand it's NOT possible to capture the packets of a third-party device on my Network? I ask this because I've read the SSH and TCP dump technique somewhere, but it's way beyond my scope of knowledge as of yet! –  Mars Jul 20 at 19:02
    
yes it is possible, but you need to set a proxy on your localhost (computer) so that you could let other devices connect to it and you monitor the traffic. i used to do this with fiddler2 with my ipad, when i was into trying to hack clash of clans :I (this is another way, entirely different than my first answer) –  H3lp3ingth3p33ps Jul 20 at 19:04
    
Well I understand clearly how the localhost proxy would work, I'll need to learn how set it up and try it. –  Mars Jul 20 at 19:16

Let's assume you don't want to perform a MITM attack (man in the middle attack) what is slightly more difficult to setup, I would suggest a network based solution:

  1. Set up an access point
  2. Connect your access point to a hub (using a regular network cable)
  3. Connect your computer (where wireshark is supposed to be running) to a hub (using a regular network cable)
  4. Connect your hub to a router (again, using a regular network cable)
  5. Start sniffing with wireshark :)
  6. Connect your Android or any other mobile device to the access point (Wifi)
share|improve this answer
    
I only have a router, it's the Access Point as well as the Modem, though I'm not sure how that's different from a "hub". –  Mars Jul 21 at 3:19
    
Your router is also a switch , which means you can't see traffic for which you're not the destination, while with a hub, traffic is sent to every device connected to it, allowing to see all the traffic that goes through the hub –  MatToufoutu Aug 20 at 12:17

I was actually playing around with this a few weeks ago, though using Burp instead of Wireshark. I routed traffic through my pentesting box by using a software defined router and redirecting with IPTables' REDIRECT target over an SSH tunnel. This is possibly overkill, but allows to redirect traffic wherever you want it. You could also do this from a router that runs linux.

Other options include setting up your computer as an access point and connecting your device to it, or using the technique described by @MatToufoutu, having Wireshark decrypt traffic, but then you might miss some traffic that is hidden by noise or out of range.

share|improve this answer
1  
I believe that while doing his tests, OP's phone and computer should be next to eachother, so distance shouldn't be a problem ^^ (at least, I did this many times and never noticed any loss) –  MatToufoutu Jul 21 at 1:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.