Is it possible to capture, using Wireshark, regular data sent by another machine inside my Wireless LAN?

  • Not without some additional trickery. For example, by setting up a fake AP. Note, you still won't be able to see the https traffic, you need to utilize a https proxy for that. – peterh - Reinstate Monica Apr 5 '19 at 16:14
  • @Glorfindel I am not so sure, that question asks for the capture, which is much easier, and not for also the decryption (maybe interception). Although the real question is probably also the decoding. – peterh - Reinstate Monica Apr 5 '19 at 16:17

Not really. Use airodump-ng for that. airodump-ng will provide PCAP-files that can be examined with Wireshark.

[edit] some explanation, because of downvote and comment:

Theoretically, you could put your Wlan card in monitoring mode

sudo ifconfig wlan1 down
sudo iwconfig wlan1 mode monitor

and use both tools to monitor the network. Ideally, you would use an interface that you reserve specifically for this purpose.

In practice though, we often see a factor more packets in the airodump output than in the wireshark output. This is not uncommon: others have reported this as well. Some have suggested that it might be a driver issue, but I have seen this on multiple Wlan devices (with different kernel modules).

So my advice is still: use airodump-ng for that.

  • Why not? Just set the wireless antenna to monitor mode and listen to that interface. Wireshark can also create pcap files btw. – Azteca Apr 5 '19 at 20:56
  • see updated answer. – Ljm Dullaart Apr 6 '19 at 11:13

Not the answer you're looking for? Browse other questions tagged or ask your own question.