1

I'm thinking to use Wireshark tool to packet capture in my Wireless network.

I read something that tells I can capture from inside or outside of my network, just making my wifi board working in "promiscuous mode". That is right? What is the difference, assuming the wifi is configured with WPA2 protocol? All of my traffic is encrypted and in the outside attemps I will have to decrypt?

  • 1
    Unrelated to this post (will delete comment later), but check how this edit should look like and how to get the formatting nested in lists. – techraf Dec 16 '16 at 3:42
2

Promiscuous mode just means your (Wireless) Network Interface Card (NIC) looks at all packets it hears, not just ones addressed to it (with its own MAC address).

With no encryption, promiscuous mode on wifi will only capture packets on the SSID that you have joined (and ignore packets on other wifi SSIDs).

With encryption (WPA2), in promiscuous mode your card will not be able to decrypt packets sent to other MAC addresses due to the encryption. Hence, promiscuous mode isn't giving you more access in this case.

There is additional RF monitor mode, which is supported by some cards that will capture all packets your wifi radio can pick up, including those your wifi card cannot decrypt. Granted if you eavesdropped on the WPA2 handshake process and know the shared secret key of the network you will be able to decrypt the traffic. (Assuming it's not additionally encrypted; e.g., a user visited an HTTPS website over WPA2-Wifi).

Hence, if you want to capture packets on other networks you need to use monitor mode. See: https://wiki.wireshark.org/CaptureSetup/WLAN#Monitor_mode

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.