1

How could I capture traffic from every AP near me? For example using tcpdump or tshark and a channel hopping script(Channel 1-11). Is this possible? I have tried with tcpdump and a channel hopping script, but I couldn't capture any "actual data". However when I used a fixed channel I could capture HTTP/TCP requests from devices on an AP in that channel.

Thank you for reading.

  • Is your WiFi adapter in monitor mode? – Joe Sep 9 '17 at 13:51
  • @Joe yes it is. – TomasLife Sep 9 '17 at 14:42
  • You won't get all traffic with one radio. You might see some traffic on a channel, but you will miss most of it during the hopping, when the radio is tuned to a different frequency. The #wificactus is one (awesome but rather silly) solution to the problem: palshack.org/the-hashtag-wifi-cactus-wificactus-def-con-25 – John Deters Sep 10 '17 at 2:28
0

I'm assuming you want to sniff 802.11 traffic, right?

Use Wireshark in Monitor Mode. When you're the menu, there should be a cog. Tick the box near Monitor, then start sniffing. You should see beacon frames and things. Also, I've written a little guide below to help you decrypt the traffic.

[Disclaimer: Please use this for educational purposes. I am not responsible for any damage you use this for. Sniffing 802.11 packets is legal as long as it has no criminal intent.]

To decrypt the traffic, you must have an 4 way handshake (EAPOL) and the WiFi password. See some things below.

Tip: Preferences > Protocols > IEEE 802.11 > Decryption Keys > (+)

The key type would be WPA2 or WEP for example. The key would have the SSID and the password.

For example, you would have it in the format of PASSWORD:SSID. Make sure to enable decryption!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.