3

Is it possible to sniff or capture 802.11 packets which sends my computer to the router (AP). I know that I can't sniff packets which have a other destination MAC address without going into monitor mode, but is it possible to capture and see the 802.11 packets which are sent from my computer to the AP and received from the AP?

I want to use my default network adapter to do this (No monitor mode support). Is it possible?

  • i. Get a network adapter that support the promiscuous mode. OR ii. Plug network to a hub, sniff from there. It is too much trouble to play "Man in the middle". – mootmoot Jul 22 '16 at 12:59
  • I don't think so, see wiki.wireshark.org/CaptureSetup/WLAN for more details. – AstroDan Jul 22 '16 at 13:41
  • Arp Poison the network into thinking you're the gateway then forward all traffic to the gateway. You'll need a beast machine for this if you have a ton of hosts however it's really easy to do. – Anthony Russell Sep 21 '16 at 1:58
1

No. You absolutely can see frames you generate or are destined for your radio without monitor mode. With the exception of the initial 802.1x handshake, unfortunately. You will need something like wireshark or tcpdump. However if you're talking about the 802.11 EAP you'll need a device you can use in monitor mode since they aren't passed through as standard frames: (might I suggest an ALFA AWUS036H)

They both rely on something called libpcap to allow you access to the layer2 messages your network devices see. Now this isn't perfect and the packets can get modified before you see them by your NIC. (eg. if you're capturing on a windows system, you'll likely see errors for TCP and IPv4 Checksum mismatches, that's due to a feature called TCP Offload Engine.) Monitor mode should get passed those limitations.

Unfortunately I'm not aware of any way to grab the pre-auth 802.1x packets without monitor mode. The first frame you'll see inside a pcap like this is likely the DHCP request frame.

What might work, is if you install a virtualization environment (VirtualBox or Vmware for instance) and then attempt to setup bridge mode on the interface and then use the virtual adapter to snoop the 802.1x frames. You will need to authenticate within your virtual machine but then you could presumably snoop it through the virtual interface.

0

I do not believe so. When the wireless card is in managed mode (the usual client mode) the card looks at the 802.11 header and passes everything else onto the kernel, so you are missing that header. In monitor mode, applications can more or less get the raw output from the wireless card, including the 802.11 header.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.