2

How would one sniff wireless network packets that do not pass directly through my computer- without access the the AP or router?

I want to be able to sniff for network traffic (even while encrypted) when authenticated to the network and when not authenticated.

Thanks

Improve this question
8
  • Are you talking about wireless or wired? Also, you want to sniff wifi for a network you are not authenticated on?
    – d1str0
    Mar 15, 2016 at 21:11
  • @d1str0 Wireless. And I would like to look at both, but I suppose the authenticated network would be easier at first.
    – userJoe
    Mar 15, 2016 at 21:13
  • You CAN capture wireless packets, but they will be useless to you unless you know they key to decrypt them.
    – xorist
    Mar 15, 2016 at 21:13
  • 1
    Well your question asked 'is it possible'. not 'how'.
    – xorist
    Mar 15, 2016 at 21:15
  • 1
    If you want to learn how to do this, I can show you. Add me on skype - l1thal. otherwise, please change your question to ask 'how' and not 'is it possible'
    – xorist
    Mar 15, 2016 at 21:17

2 Answers 2

Reset to default
2

Yes. You are looking for promiscuous mode or monitor mode.

https://security.stackexchange.com/a/37000/28585

Improve this answer
3
  • Thanks. So would Wireshark do the job by itself or is it necessary to use Aircrack-ng suite...assuming you're authenticated?
    – userJoe
    Mar 15, 2016 at 21:18
  • If only it was enough...There are so much more to it than this.
    – Rui F Ribeiro
    Mar 15, 2016 at 22:37
  • 1
    Nope, promiscuous mode won't necessarily work; you probably need monitor mode.
    – user26774
    Mar 15, 2016 at 23:28
3

You need to run in monitor mode; promiscuous mode doesn't always work with Wi-Fi adapters (and may not even be supported for Wi-Fi on some OSes or with some Wi-Fi adapters).

Whether Wireshark can do it by itself depends on the OS. On OS X, it can; on Linux, it could, in theory, but for complicated reasons it can't, on most if not all distributions, in practice, so you need aircrack-ng's airmon-ng script to turn monitor mode on, and you can capture after that; on Windows, it can't do it at all except with an AirPcap adapter; on other OSes, maybe, maybe not. See the Wireshark Wiki's page on WLAN capturing for details.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .