I am trying to look at traffic between my phone and the outside world, and for whatever reason I can't see the outside world's traffic coming in.

I am running Wireshark on a Kali box, I turned on the monitor mode interface, and then setup Wireshark to capture. I can see the outgoing traffic just fine, but can't see the responses, e.g. SYN and ACK messages, but no SYN/ACK. I tried using a display filter with ip.addr==w.x.y.z, but the only traffic captured had the phone's IP as the source, never the destination.

Is there a setting I am missing somewhere? Could this possibly be a hardware limitation that is preventing the capture of inbound traffic?

I ran many Google searches, but all I could find were results on not being able to see outbound traffic.

Edit Here is a rough diagram of the network layout-

       Traffic between devices
Phone <------------------------> Wifi Hotspot
        Kali sniffing Traffic

Traffic goes from the phone to the hotspot and back with Kali listening in. Kali can see the traffic from the phone to hotspot, but isn't seeing the hotspot to phone traffic. In other words, the source address is always the phone's IP. As I said above, I used the ip.addr== filter which from everything I've read is supposed to show traffic to and from the device.

  • We need to know more about the network configuration you have set up. If you're running Kali on a wireless computer, please note that not all wireless nics play nicely with Wireshark and you can end up getting only half the communication. – schroeder Jun 8 '14 at 20:02
  • Im using a Hawking HAWNU1 USB antenna with a Ralink RT3070 chipset and usb: rt2800usb driver. Wifi is provided from a Huawei hotspot puc on channel 9, changed the settings to .11b/g, since I read somewhere that .11n caused issues. mon0 has promisc turned on, and wireshark has capture in promisc mode set as well. Let me know what other information you need – gr0k Jun 8 '14 at 20:34
  • How are you setting the man in the middle computer? is your Kali acting as a router to your phone? Give us a network map and we will help you – AK_ Jun 8 '14 at 22:58
  • It's not a MITM setup, Im sniffing the traffic between two devices. Added a rough diagram in the OP – gr0k Jun 9 '14 at 4:52
  • AK might have a potential troubleshooting step. What happens if you use your kali machine as a MitM AP? You should see all traffic then, even if it is not the optimal setup you hoped for. – schroeder Jun 9 '14 at 17:10

I would suggest you set up an access point with Kali. Using this approach you can even set up a transparent proxy and open SSL Tunnels to sniff on ssl traffic.

Apps that verify certificates might still give you trouble and wont initiate connections tough (as they should).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.