2

I'm thinking to use Wireshark tool to packet capture in my Wireless network.

I read something that tells I can capture from inside or outside of my network, just making my wifi board working in "promiscuous mode". That is right? What is the difference, assuming the wifi is configured with WPA2 protocol? All of my traffic is encrypted and in the outside attemps I will have to decrypt?

Improve this question
1
  • 1
    Unrelated to this post (will delete comment later), but check how this edit should look like and how to get the formatting nested in lists.
    – techraf
    Commented Dec 16, 2016 at 3:42

1 Answer 1

Reset to default
3

Promiscuous mode just means your (Wireless) Network Interface Card (NIC) looks at all packets it hears, not just ones addressed to it (with its own MAC address).

With no encryption, promiscuous mode on wifi will only capture packets on the SSID that you have joined (and ignore packets on other wifi SSIDs).

With encryption (WPA2), in promiscuous mode your card will not be able to decrypt packets sent to other MAC addresses due to the encryption. Hence, promiscuous mode isn't giving you more access in this case.

There is additional RF monitor mode, which is supported by some cards that will capture all packets your wifi radio can pick up, including those your wifi card cannot decrypt. Granted if you eavesdropped on the WPA2 handshake process and know the shared secret key of the network you will be able to decrypt the traffic. (Assuming it's not additionally encrypted; e.g., a user visited an HTTPS website over WPA2-Wifi).

Hence, if you want to capture packets on other networks you need to use monitor mode. See: https://wiki.wireshark.org/CaptureSetup/WLAN#Monitor_mode

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .