EDIT: I found the issue.

The interface is still in managed mode. I tried to add manually a new interface. iw phy phy0 info tells that my NIC supports the monitor mode but if I try to add a new interface with sudo iw phy phy0 interface add mon0 type monitor I get the following:

blackbrain@blackbrain-host:~$ iw dev
phy#0
    Interface mon0
        ifindex 5
        wdev 0x3
        addr 34:68:95:03:48:17
        type managed
    Interface wlo1
        ifindex 3
        wdev 0x1
        addr 34:68:95:03:48:17
        type managed
        channel 7 (2442 MHz), width: 20 MHz, center1: 2442 MHz

both interface are in managed mode.

Any idea?

I'm connected to my WiFi network and I want to capture and analyze packets that other clients are exchanging with the gateway. I don't want to modify the content of these packets and I don't need to read the content of every packet.

Actually, the wlan configuration is the following:

• a router 192.168.1.1
• the laptop that I'm using to sniff traffic 192.168.1.9
• my smartphone 192.168.1.2

so I want to be able to see (part of) the traffic between my smartphone and the router.

To achieve the goal I set the wireless interface in promisc mode with sudo ip link wlo1 promisc on and I check if it is enabled with netstat -i:

Kernel Interface table
Iface   MTU Met   RX-OK RX-ERR RX-DRP RX-OVR    TX-OK TX-ERR TX-DRP TX-OVR Flg
enp8s0     1500 0     28962      0      1 0         22923      0      0      0 BMU
lo        65536 0      7294      0      0 0          7294      0      0      0 LRU
wlo1       1500 0     29469      0      0 0         12236      0      0      0 BMPRU

The P on the flag column indicates the promisc mode, so I'm assuming it is enabled. Since the promisc mode is on, I should see all the traffic that my NIC can capture. Then I open wireshark and I start to capture traffic on wlo1 interface but I don't see any packets from source 192.168.1.2 and I'm surfing the net with my smartphone (so, I'm generating traffic).

What am I doing wrong?

I'm connected to my WiFi network and I want to capture and analyze packets that other clients are exchanging with the gateway. I don't want to modify the content of these packets and I don't need to read the content of every packet.

Actually, the wlan configuration is the following:

• a router 192.168.1.1
• the laptop that I'm using to sniff traffic 192.168.1.9
• my smartphone 192.168.1.2

so I want to be able to see (part of) the traffic between my smartphone and the router.

To achieve the goal I set the wireless interface in promiscuous mode with sudo ip link wlo1 promiscuous on and I check if it is enabled with netstat -i:

Kernel Interface table
Iface   MTU Met   RX-OK RX-ERR RX-DRP RX-OVR    TX-OK TX-ERR TX-DRP TX-OVR Flg
enp8s0     1500 0     28962      0      1 0         22923      0      0      0 BMU
lo        65536 0      7294      0      0 0          7294      0      0      0 LRU
wlo1       1500 0     29469      0      0 0         12236      0      0      0 BMPRU

The P on the flag column indicates the promiscuous mode, so I'm assuming it is enabled. Since the promiscuous mode is on, I should see all the traffic that my NIC can capture. Then I open wireshark and I start to capture traffic on wlo1 interface but I don't see any packets from source 192.168.1.2 and I'm surfing the net with my smartphone (so, I'm generating traffic).

What am I doing wrong?