I'm connected to my WiFi network and I want to capture and analyze packets that other clients are exchanging with the gateway. I don't want to modify the content of these packets and I don't need to read the content of every packet.
Actually, the wlan configuration is the following:
- a router
- the laptop that I'm using to sniff traffic
- my smartphone
so I want to be able to see (part of) the traffic between my smartphone and the router.
To achieve the goal I set the wireless interface in promiscuous mode with
sudo ip link wlo1 promiscuous on and I check if it is enabled with
Kernel Interface table Iface MTU Met RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg enp8s0 1500 0 28962 0 1 0 22923 0 0 0 BMU lo 65536 0 7294 0 0 0 7294 0 0 0 LRU wlo1 1500 0 29469 0 0 0 12236 0 0 0 BMPRU
P on the flag column indicates the promiscuous mode, so I'm assuming it is enabled. Since the promiscuous mode is on, I should see all the traffic that my NIC can capture. Then I open wireshark and I start to capture traffic on
wlo1 interface but I don't see any packets from source
192.168.1.2 and I'm surfing the net with my smartphone (so, I'm generating traffic).
What am I doing wrong?
EDIT: I found the issue.
The interface is still in managed mode. I tried to add manually a new interface.
iw phy phy0 info tells that my NIC supports the monitor mode but if I try to add a new interface with
sudo iw phy phy0 interface add mon0 type monitor I get the following:
blackbrain@blackbrain-host:~$ iw dev phy#0 Interface mon0 ifindex 5 wdev 0x3 addr 34:68:95:03:48:17 type managed Interface wlo1 ifindex 3 wdev 0x1 addr 34:68:95:03:48:17 type managed channel 7 (2442 MHz), width: 20 MHz, center1: 2442 MHz
both interface are in managed mode.