On linux kali. I got an Atheros wireless adapater. I'm trying to capture data packets off the air and decrypt them as an exercise. I apologize if this question is silly. The problem is that when I turn on the wifi monitor mode and choose an appropriate channel, Wireshark can catch 802.11 management packets such as beacon, probe_request, but it can't catch any user data packets such as the tcp packets. After I turn the wifi back to managed mode and connect to an AP, I can catch user data packets again. Is this the way I should expect Wireshark to behave? Thank you.

  • What security mode does the target network use? – multithr3at3d Sep 4 '20 at 23:33

This behavior isn't specific to Wireshark but is due to how wireless network cards work. Keep in mind that in monitor mode, your wireless card is completely passive and has no concept of being connected to any particular network. So, if a network is secured with encryption, the card itself won't know how to decrypt those frames and you should just see them identified as 802.11 QoS in Wireshark. Without any additional configuration, you will only be able to see the network traffic of an open (unsecured/unencrypted) network.

However, if it's your own network, you already have the network's PSK, and should be able to decrypt the traffic the way you expect using Wireshark. Note that in order to decrypt a particular session between a device and the access point, you need to capture the 4-way handshake that is performed during initial connection with the network. This can be forced by reconnecting the device(s) or by kicking the target device(s) off the network with a deauthentication attack.

Also, it is likely that you are only capturing your own wireless traffic if running Wireshark while connected to the wireless network.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.