1

When sniffing wireless packets from multiple networks, how do you tell which network a packet belongs to?


The best guess I have right now is that you need to see the handshakes and get the mac addr from the Ethernet frame. This seems inconvenient

  • 2
    A packet has a source and destination address. Is this not sufficient enough to determine which network the packet comes from? – pm1391 Feb 28 '18 at 4:01
  • I don't think it would work for local networks with their own private addresses. – Alter Feb 28 '18 at 4:07
  • I hope you are not sniffing networks that don't belong to you. But, if your network consists of multiple subnets, it is relatively easy to determine where packets are going. The MAC address of a host has nothing to do with what network it is attached to. Maybe I am misunderstanding the question – pm1391 Feb 28 '18 at 4:11
  • It's pretty much easy to see everything (including Ethernet Farme) related to a packet in Wireshark tool. Have you tried it ? – C0deDaedalus Feb 28 '18 at 4:33
  • Moloch is also a great alternative to wireshark. A bit more visually pleasing – pm1391 Feb 28 '18 at 4:44
1

These are worth a read:

Some network cards will provide 802.11 headers (including the SSID which you can use to identify the network), other network cards strip those and present WiFi as regular Ethernet.

  • I'm not having much luck getting 802.11 headers with my environment, so it may be an issue with the network card. Those sources were useful, I didn't realize it was limited to only one channel either. – Alter Feb 28 '18 at 17:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.