1

I am trying to capture packets from other devices that are connected to the same network as I am. I know the difference between monitor mode and promiscuous mode (explained in this question), but for my purposes I feel that promiscuous mode is more useful.

My problem is, how can I configure a wireless interface to capture the traffic in promiscuous mode?

(FYI: I have already captured traffic in monitor mode, but it's useless as the traffic is encrypted. Also, I am trying this on a Raspberry Pi 3B+ with Kali linux with Nexmon installed, if that's any help. However, I can use Raspbian as well, if necessary)

1
  • You're better off using monitor mode, and decrypting the traffic with the network's key. Commented Jul 7, 2019 at 21:16

2 Answers 2

2

I am trying to capture packets from other devices that are connected to the same network as I am.
... I feel that promiscuous mode is more useful.
... the traffic is encrypted.

Promiscuous mode is likely not what you want.

To cite from the WireShark Wiki: "However, on a "protected" network, packets from or to other hosts will not be able to be decrypted by the adapter, and will not be captured, so that promiscuous mode works the same as non-promiscuous mode."

Note that this is not a restriction of WireShark but a restriction due to the design of protected WLAN. Thus it will not help to just change the capture tool.

See also Wireshark - I can't see traffic of other computer on the same network in promiscuous mode.

2
  • What if I am connected to the network? (as another device)
    – Nht_e0
    Commented Jul 7, 2019 at 21:28
  • 1
    @Nht_e0: it does not help. The encryption keys in WPA2 are pairwise between the devices. Since the local network card does not know the encryption keys of the other devices it cannot decrypt the traffic. For more see security.stackexchange.com/a/89083/37315 Commented Jul 7, 2019 at 21:39
0

You go to the interfaces window *

Note: "Even in promiscuous mode you still won’t necessarily see all packets on your LAN segment. See the Wireshark FAQ for more information."

*(capture>opt>enable promiscuous mode)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .