4

I have a wireless card (AWUS036H) in monitor mode (with airmon-ng start wlan0) on my Debian machine. In Wireshark, in "capture options", all my interfaces are in promiscuous mode.

The test network is a Wi-Fi network protected by WEP (I have the key).

In Wireshark, I only see information packets (Probe requests, beacon frames, etc.), but no "real" traffic, even if I'm using the network with another device connected to the network. Why?

Improve this question
4
  • and you followed the Wireshark process: wiki.wireshark.org/HowToDecrypt802.11 ?
    – schroeder ♦
    Apr 4, 2016 at 15:48
  • Yeah, of course. But I can't see the "Description key" button (part "Adding Keys: Wireless Toolbar"). But I thought that I could see the non-decrypted traffic nevertheless.
    – Shan-x
    Apr 4, 2016 at 16:11
  • 1
    Shouldn't this question be on superuser?
    – Mindwin Remember Monica
    Apr 4, 2016 at 17:49
  • Try locking onto a channel e.g. airmon-ng start wlan0 6
    – KDEx
    Apr 5, 2016 at 2:44

1 Answer 1

Reset to default
1

Be sure to have disabled on AP the "client isolation" option. That could be the problem. If you are pretty sure that everything is good set up.

To check this you can do a test without sniffing... just connect two clients to the network using the WEP key you already have and try to communicate between them. A ping is a good test if you have no icmp filter on both devices/pcs . If you can't ping between them, I guess you have that "client isolation" option that is crashing your sniffing tests. If you can ping, then there is no "client isolation" and you must dig into wireshark config to try to setup correctly the WEP key, the channel or whatever.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .