1

How could I capture traffic from every AP near me? For example using tcpdump or tshark and a channel hopping script(Channel 1-11). Is this possible? I have tried with tcpdump and a channel hopping script, but I couldn't capture any "actual data". However when I used a fixed channel I could capture HTTP/TCP requests from devices on an AP in that channel.

Thank you for reading.

3
  • Is your WiFi adapter in monitor mode?
    – Joe
    Sep 9, 2017 at 13:51
  • @Joe yes it is.
    – TomasLife
    Sep 9, 2017 at 14:42
  • You won't get all traffic with one radio. You might see some traffic on a channel, but you will miss most of it during the hopping, when the radio is tuned to a different frequency. The #wificactus is one (awesome but rather silly) solution to the problem: palshack.org/the-hashtag-wifi-cactus-wificactus-def-con-25 Sep 10, 2017 at 2:28

1 Answer 1

0

I'm assuming you want to sniff 802.11 traffic, right?

Use Wireshark in Monitor Mode. When you're the menu, there should be a cog. Tick the box near Monitor, then start sniffing. You should see beacon frames and things. Also, I've written a little guide below to help you decrypt the traffic.

[Disclaimer: Please use this for educational purposes. I am not responsible for any damage you use this for. Sniffing 802.11 packets is legal as long as it has no criminal intent.]

To decrypt the traffic, you must have an 4 way handshake (EAPOL) and the WiFi password. See some things below.

Tip: Preferences > Protocols > IEEE 802.11 > Decryption Keys > (+)

The key type would be WPA2 or WEP for example. The key would have the SSID and the password.

For example, you would have it in the format of PASSWORD:SSID. Make sure to enable decryption!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .