I am trying to look at traffic between my phone and the outside world, and for whatever reason I can't see the outside world's traffic coming in.
I am running Wireshark on a Kali box, I turned on the monitor mode interface, and then setup Wireshark to capture. I can see the outgoing traffic just fine, but can't see the responses, e.g. SYN and ACK messages, but no SYN/ACK. I tried using a display filter with ip.addr==w.x.y.z, but the only traffic captured had the phone's IP as the source, never the destination.
Is there a setting I am missing somewhere? Could this possibly be a hardware limitation that is preventing the capture of inbound traffic?
I ran many Google searches, but all I could find were results on not being able to see outbound traffic.
Edit Here is a rough diagram of the network layout-
Traffic between devices
Phone <------------------------> Wifi Hotspot
|
|
|
Kali sniffing Traffic
Traffic goes from the phone to the hotspot and back with Kali listening in. Kali can see the traffic from the phone to hotspot, but isn't seeing the hotspot to phone traffic. In other words, the source address is always the phone's IP. As I said above, I used the ip.addr== filter which from everything I've read is supposed to show traffic to and from the device.
