After my house mate experienced consistent ping spikes whilst gaming, he asked me to check/set the wireless router password. I did and I found two intruders from obviously nearby. How can the data they send to my wireless router be captured for analysis?
If you're on a Linux machine, install
First, find out your netmask (should be 255.255.255.0 for a normal home network). You can do this with
ifconfig wlan0|grep Mask|sed s/^.*Mask://)
sudo ettercap -T -M -i wlan0 ARP // // -n 255.255.255.0
If you know the IP of the intruders, you can put it between the first slashes:
sudo ettercap -T -M -i wlan0 ARP /192.168.1.101,192.168.1.102/ // -n 255.255.255.0
255.255.255.0 with your netmask)
You may have to wait a bit for it to load. In the meantime, open Wireshark:
Open a new terminal and run
gksudo wireshark&. Use the second (wrench) button in the Wireshark menu, set the network interface to
wlan0, and start the capture. You should be able to see all the packets in the network (unless you filtered by source IP in ettercap).
Get the latest BackTrack (which is now called Kali) using the airmon-ng program set your wireless card in monitor mode then using airodump-ng start capturing packets on your channel. You don't have to be authenticated with your wireless router because at this point you're just getting the encrypted wireless traffic. Once you have enough traffic that you want to analyze decrypt the packets with WireShark.
PROS of this method
This is the least intrusive, most quiet method of capturing and analyzing the data. Manishearth's answer will work however in that situation you're performing a man in the middle attack by flooding the network with arp packets which can be easily detected.
CONS of this method
You will not be able to see any encrypted traffic such as SSL where in Manishearth's answer you will as long as the vicitm is not so smart. In his answer when victim attempts to make a secure connection they will be shown a warning that the connection they're about to make is insecure. Most of the time people will just click through that and if/when they do you will be able to see the data even in that secure connection.
My advice is to try this method first and if it doesn't give you the results you're looking for then go for the active approach.
You will need to use a wireless adapter and matching set of drivers that can be used in "monitor mode" (see wireshark's help page on the subject). That usually require you to use a Linux distro and to have a compatible wireless adapter: not very hard to find but oyu might not have one.
A simpler way (at least, from my point of view) would be to setup a system to act as a router between your wireless access point and your other networks (internal as well as WAN) and capture traffic from there: you'll have no need to decode 802.1* and you have plenty of additional option to have some fun with them.