1

I wanted to do some in-house research and check how many and what kind of packets I can capture from/to my in-house open Wi-Fi router.

I had Kali Linux installed on Windows 10 machine (Virtualbox) and I use TP-Link TL-WN722N Wi-Fi adapter to capture traffic in monitor mode. I can put it in monitor mode, and I can see captured packets.

However, only small amount of traffic is captured, particularly HTTP packets. I did some test requests from my phone/tablet/laptop and I sometimes get pretty reasonable count of packets captured, but sometimes I can't see any of them or just part of request (for example some script is loaded from CDN, but no original request is captured).

As my knowledge about networking is really basic, I'm interested what can cause that?

P.S.: Wi-Fi card is set to correct channel - same as my Wi-Fi router is broadcasting.

UPDATE (2019)

If some of you are experiencing same this answer helped me, so data was transfered in different rates, and TL-WN722N was not able to catch thos packets. Removing 802.11n (leaving only b/g) fixed the issue.

Improve this question
5
  • Do you mean by "i can't see any of them" that there are packets but they contain no visible HTTP traffic or that no packets appear in wireshark at all?
    – Denis
    Mar 20, 2017 at 16:37
  • Sorry for not makeing it clear, for some portion of time it will not intercept any off http packets, though i'm sending http request from my test device constantly
    – Arturas Tamulaitis
    Mar 20, 2017 at 16:42
  • Just to be clear: You are sending http requests or https requests?
    – Denis
    Mar 20, 2017 at 16:43
  • Just http and capturing the same, test pahe is also on my remote server so im sure there are no redirect shenanigans
    – Arturas Tamulaitis
    Mar 20, 2017 at 16:49
  • If you're using a VM make sure you have enough resources for the Guest VM, remember that capturing packets sometimes can be process intensive, which can cause packets to drop/loss.
    – Azteca
    Mar 21, 2017 at 17:42

2 Answers 2

Reset to default
1

My first guess would be the strength of the wifi signal, are you close enough from both router AND target computer? Maybe you're close to one but far from other, meaning that you will not properly capture packets from both.

Check using airodump if you have at least -67dBm of signal for both router and target. Also, remember that the signal is in a logarithm scale, the higher the number, better. If you get a signal around -50dBm would be good.

If you have good signal from both router and target machine, try to do the capture using airodump-ng [ airodump-ng wlan0mon -c CHANNEL --bssid ROUTER_MAC -w CAPTURE_FILE ] and then open the saved capture on wireshark. From my experience, airodump is more reliable (and you can see in real time the signal strength)

Improve this answer
3
  • Not at the home right now, but while i was doing checks i was standing next to router and signal quality was between -40-50dBm, the strange part is that sometimes (maybe for 5-10minutes) i do get 100% catpture quality. My first thought was it's hapening due channel hopping, but nope my adapter was set to correct chanel and not hopping
    – Arturas Tamulaitis
    Mar 20, 2017 at 16:40
  • Were you also close to the target machine? Depending on the positioning, sometimes if you're close to the router but not close to the target machine, you may get only packets generated by the router, but not by the target machine. Try the airodump-ng, it's the most reliable way to capture (in my opinion), sometimes wireshar may be filtering something.
    – Ricardo Reimao
    Mar 20, 2017 at 16:46
  • I tried a lot off different locations for both intercept device and devive which sends packets, and the result looks always more time interval based rather then position based. Also i did tests with three different tools tcpdump/dumpcap and airodump and results are almost always identical except ratio off droped packets (which is not significant)
    – Arturas Tamulaitis
    Mar 20, 2017 at 16:54
1

I use wireshark on a daily basis for network analysis.

You will want to make sure you are sniffing of the correct interface first of all, as well as making sure you have the required parser enabled (HTTP in this case).

You will want to verify you are re-assembling headers as well: enter image description here

I'd also verify that the strength to your router is adequate and you are not losing any packets.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .