My problem is that I cannot capture any frames other than broadcast or multicast over Wireshark on my WLAN interface (eg. no ICMP packets, no HTTP packets, etc.)

Please follow details below:

  • OS: Linux KALI 2016.1 Rolling Release 64bit (u#1 SMP Debian 4.3.3-5kali4)
  • NIC: Linksys WUSB600Nv2 Dual-Band (RaLink RT3572 - Driver: rt2800usb - mac80211: capable - Assigned as WLAN0)
  • WLAN0 put to monitor mode (using airmon-ng start wlan0) therefore listening on wlan0mon Channel 01 on Wireshark
  • Test AP: Linksys E3000 on Channel 01 - Open security no encryption
  • Second Client: Win7 Laptop pinging the AP (ICMPv4) & Surfing web
  • Wireshark version 2.0.3

However I cannot capture any UNICAST frames. Please tell me what I am missing,


2 Answers 2


So that everyone knows the problem was with the Kernel, there's a new issue with kernels below v4.4.0 with RT chipset (on KALI).

Upgrading the kernel solved the issue.


Use the filters not broadcast and not multicast so that only unicast traffic remains. That should make thinks a lot more clear.

If unicast traffic does not show, you may have an anti-virus interfering with the traffic capture.

  • Thx for the quick reply, 1. I applied the filter the outcome was no packets at all. 2. No antivirus or firewall is running unless there's one built-in on KALI that I am not aware of. any thoughts? Jun 7, 2016 at 6:58
  • Do you see any ARP requests in Wireshark?
    – Overmind
    Jun 7, 2016 at 7:04
  • Yes I can see ARP request Jun 7, 2016 at 7:04
  • Double check if somehow UFW is installed. Command: ufw disable - it will disable if it's installed and active.
    – Overmind
    Jun 7, 2016 at 7:09
  • Checked it, not installed ("command not found") Jun 7, 2016 at 7:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .