1

When sniffing wireless packets from multiple networks, how do you tell which network a packet belongs to?


The best guess I have right now is that you need to see the handshakes and get the mac addr from the Ethernet frame. This seems inconvenient

5
  • 2
    A packet has a source and destination address. Is this not sufficient enough to determine which network the packet comes from?
    – pm1391
    Feb 28, 2018 at 4:01
  • I don't think it would work for local networks with their own private addresses.
    – Alter
    Feb 28, 2018 at 4:07
  • I hope you are not sniffing networks that don't belong to you. But, if your network consists of multiple subnets, it is relatively easy to determine where packets are going. The MAC address of a host has nothing to do with what network it is attached to. Maybe I am misunderstanding the question
    – pm1391
    Feb 28, 2018 at 4:11
  • It's pretty much easy to see everything (including Ethernet Farme) related to a packet in Wireshark tool. Have you tried it ? Feb 28, 2018 at 4:33
  • Moloch is also a great alternative to wireshark. A bit more visually pleasing
    – pm1391
    Feb 28, 2018 at 4:44

1 Answer 1

1

These are worth a read:

Some network cards will provide 802.11 headers (including the SSID which you can use to identify the network), other network cards strip those and present WiFi as regular Ethernet.

1
  • I'm not having much luck getting 802.11 headers with my environment, so it may be an issue with the network card. Those sources were useful, I didn't realize it was limited to only one channel either.
    – Alter
    Feb 28, 2018 at 17:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .