1

In a wireless network, does wireshark sniffs all the packets that are in move, or only packets whom we are the destination/source ?

If it sniffs all the packets in the air, can someone explain or give me a book or a tutorial that explains how wireshark can do this ?

3

Wireshark attaches to an interface, it may be your wireless interface or even loopback. Then it intercepts every packet in that network.

If your interface is in promiscuous mode then it will capture everything in the network that this interface is connected to, but not everything in the air, just what goes on in that network and in that interface.

Edit suggested by AstroDan: The official WireShark documentation includes a section about Promiscuous mode that is worth reading

0

In a wireless network, does wireshark sniffs all the packets that are in move, or only packets whom we are the destination/source ?

If the adapter is in monitor mode, it sniffs all packets that the radio receives. If it's not in monitor mode, it only seems packets sent to or from the machine. (Promiscuous mode may, or may not, work on Wi-Fi adapters.)

If it sniffs all the packets in the air, can someone explain

At the physical level, LAN adapters receive every packet on the wire to which they're attached, for wired LANs, and every packet on the channel to which they're tuned, for wireless LANs. The adapters normally look at the destination address and discard all packets not sent to one of the adapter's MAC unicast addresses, not sent to the broadcast address, and not sent to a multicast address to which the adapter is listening. In promiscuous or monitor mode, that check is turned off.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.