Can't see data packets when capturing in monitor mode

Question

On Kali Linux, I have an Atheros wireless adapater. I'm trying to capture data packets off the air and decrypt them as an exercise. The problem is that when I turn on the wifi monitor mode and choose an appropriate channel, Wireshark can catch 802.11 management packets such as beacon, probe_request, but it can't catch any user data packets such as the TCP packets. After I turn the wifi back to managed mode and connect to an AP, I can catch user data packets again. Is this the way I should expect Wireshark to behave?

Answer 1

This behavior isn't specific to Wireshark but is due to how wireless network cards work. Keep in mind that in monitor mode, your wireless card is completely passive and has no concept of being connected to any particular network. So, if a network is secured with encryption, the card itself won't know how to decrypt those frames and you should just see them identified as 802.11 QoS in Wireshark. Without any additional configuration, you will only be able to see the network traffic of an open (unsecured/unencrypted) network.

However, if it's your own network, you already have the network's PSK, and should be able to decrypt the traffic the way you expect using Wireshark. Note that in order to decrypt a particular session between a device and the access point, you need to capture the 4-way handshake that is performed during initial connection with the network. This can be forced by reconnecting the device(s) or by kicking the target device(s) off the network with a deauthentication attack.

Also, it is likely that you are only capturing your own wireless traffic if running Wireshark while connected to the wireless network.