I have a wireless card (AWUS036H) in monitor mode (with airmon-ng start wlan0) on my Debian machine. In Wireshark, in "capture options", all my interfaces are in promiscuous mode.

The test network is a Wi-Fi network protected by WEP (I have the key).

In Wireshark, I only see information packets (Probe requests, beacon frames, etc.), but no "real" traffic, even if I'm using the network with another device connected to the network. Why?

  • and you followed the Wireshark process: wiki.wireshark.org/HowToDecrypt802.11 ? – schroeder Apr 4 '16 at 15:48
  • Yeah, of course. But I can't see the "Description key" button (part "Adding Keys: Wireless Toolbar"). But I thought that I could see the non-decrypted traffic nevertheless. – Shan-x Apr 4 '16 at 16:11
  • Shouldn't this question be on superuser? – Mindwin Apr 4 '16 at 17:49
  • Try locking onto a channel e.g. airmon-ng start wlan0 6 – KDEx Apr 5 '16 at 2:44

Be sure to have disabled on AP the "client isolation" option. That could be the problem. If you are pretty sure that everything is good set up.

To check this you can do a test without sniffing... just connect two clients to the network using the WEP key you already have and try to communicate between them. A ping is a good test if you have no icmp filter on both devices/pcs . If you can't ping between them, I guess you have that "client isolation" option that is crashing your sniffing tests. If you can ping, then there is no "client isolation" and you must dig into wireshark config to try to setup correctly the WEP key, the channel or whatever.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.