1

My problem is that I cannot capture any frames other than broadcast or multicast over Wireshark on my WLAN interface (eg. no ICMP packets, no HTTP packets, etc.)

Please follow details below:

  • OS: Linux KALI 2016.1 Rolling Release 64bit (u#1 SMP Debian 4.3.3-5kali4)
  • NIC: Linksys WUSB600Nv2 Dual-Band (RaLink RT3572 - Driver: rt2800usb - mac80211: capable - Assigned as WLAN0)
  • WLAN0 put to monitor mode (using airmon-ng start wlan0) therefore listening on wlan0mon Channel 01 on Wireshark
  • Test AP: Linksys E3000 on Channel 01 - Open security no encryption
  • Second Client: Win7 Laptop pinging the AP (ICMPv4) & Surfing web
  • Wireshark version 2.0.3

However I cannot capture any UNICAST frames. Please tell me what I am missing,

1

So that everyone knows the problem was with the Kernel, there's a new issue with kernels below v4.4.0 with RT chipset (on KALI).

Upgrading the kernel solved the issue.

0

Use the filters not broadcast and not multicast so that only unicast traffic remains. That should make thinks a lot more clear.

If unicast traffic does not show, you may have an anti-virus interfering with the traffic capture.

  • Thx for the quick reply, 1. I applied the filter the outcome was no packets at all. 2. No antivirus or firewall is running unless there's one built-in on KALI that I am not aware of. any thoughts? – BahmanTheGreat Jun 7 '16 at 6:58
  • Do you see any ARP requests in Wireshark? – Overmind Jun 7 '16 at 7:04
  • Yes I can see ARP request – BahmanTheGreat Jun 7 '16 at 7:04
  • Double check if somehow UFW is installed. Command: ufw disable - it will disable if it's installed and active. – Overmind Jun 7 '16 at 7:09
  • Checked it, not installed ("command not found") – BahmanTheGreat Jun 7 '16 at 7:12

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.