1

My problem is that I cannot capture any frames other than broadcast or multicast over Wireshark on my WLAN interface (eg. no ICMP packets, no HTTP packets, etc.)

Please follow details below:

  • OS: Linux KALI 2016.1 Rolling Release 64bit (u#1 SMP Debian 4.3.3-5kali4)
  • NIC: Linksys WUSB600Nv2 Dual-Band (RaLink RT3572 - Driver: rt2800usb - mac80211: capable - Assigned as WLAN0)
  • WLAN0 put to monitor mode (using airmon-ng start wlan0) therefore listening on wlan0mon Channel 01 on Wireshark
  • Test AP: Linksys E3000 on Channel 01 - Open security no encryption
  • Second Client: Win7 Laptop pinging the AP (ICMPv4) & Surfing web
  • Wireshark version 2.0.3

However I cannot capture any UNICAST frames. Please tell me what I am missing,

Improve this question
0

2 Answers 2

Reset to default
1

So that everyone knows the problem was with the Kernel, there's a new issue with kernels below v4.4.0 with RT chipset (on KALI).

Upgrading the kernel solved the issue.

Improve this answer
0
0

Use the filters not broadcast and not multicast so that only unicast traffic remains. That should make thinks a lot more clear.

If unicast traffic does not show, you may have an anti-virus interfering with the traffic capture.

Improve this answer
8
  • Thx for the quick reply, 1. I applied the filter the outcome was no packets at all. 2. No antivirus or firewall is running unless there's one built-in on KALI that I am not aware of. any thoughts?
    – BahmanTheGreat
    Jun 7, 2016 at 6:58
  • Do you see any ARP requests in Wireshark?
    – Overmind
    Jun 7, 2016 at 7:04
  • Yes I can see ARP request
    – BahmanTheGreat
    Jun 7, 2016 at 7:04
  • Double check if somehow UFW is installed. Command: ufw disable - it will disable if it's installed and active.
    – Overmind
    Jun 7, 2016 at 7:09
  • Checked it, not installed ("command not found")
    – BahmanTheGreat
    Jun 7, 2016 at 7:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .