1

So here is my setup

  • Desktop booting a live version of Kali from a USB drive
  • The standard distro of wireshark that comes with Kali
  • A Ralink RT-3070L High gain antenna
  • My home network as a sandbox.

When I run wireshark (with my antenna in promiscuous mode) I only see a very small amount of packets from other machines.

I see everything from the machine I am on and I see some things coming from the router.

From my understanding this is indicative of running in Monitor mode. However, that's not what the settings are telling me and I know for a fact this antenna can work in promiscuous mode. Am I missing something?

closed as off-topic by schroeder, TildalWave, Mark, gowenfawr, AJ Henderson Oct 28 '14 at 14:57

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – schroeder, Mark, gowenfawr, AJ Henderson
If this question can be reworded to fit the rules in the help center, please edit the question.

  • What do you expect to see? – user1720897 Sep 27 '14 at 16:41
  • I have a number of devices on my network. A Surface pro, lumia 920, xbox one, kindle.... I expect to see something other that my personal machines traffic. There is clearly something not configured correctly – Anthony Russell Sep 27 '14 at 16:44
  • When you run iwconfig, what mode is the WLAN adapter in? – user1720897 Sep 27 '14 at 16:48
  • When I run iqconfig it says it's in Managed mode – Anthony Russell Sep 27 '14 at 16:51
  • 1
    Then its not in promiscuous(or Monitor) mode. Run something similar to airmon-ng start wlan0 to bring it to 'Monitor' mode. Substitute wlan0 with whatever is applicable on your desktop. – user1720897 Sep 27 '14 at 16:55
2

Put your Wifi card in monitor mode by doing something similar to airmon-ng start wlan0. Then run Wireshark on that interface. You should be able to see some packets other than those meant for your desktop. However when you put it in monitor mode it constantly keeps hopping over the various channels. It'll only capture packets on the channel it is currently on. Hence if all your devices are on different channels, it'll be difficult to monitor all the packets in the air. You can have your access point to use only a specific channel, put the Wifi card on that specific channel(look at airmon-ng options), then sniff with Wireshark on that interface.

  • I restarted my live instance so I was starting from fresh. I connected to my wifi network. I opened terminal. I typed airmon-ng start wlan0 (because my wireless interface is wlan0) it said "(monitor mode enabled on mon0)" I opened wireshark and started listening on wlan0. All I see is arp requests. – Anthony Russell Sep 27 '14 at 18:11
  • You need to make sure you tie all your devices, your access point and the WiFi card to the same channel – user1720897 Sep 27 '14 at 18:15
  • This still produces the same results – Anthony Russell Sep 28 '14 at 14:12
  • 1
    @AnthonyRussell Try listening on mon0 instead of wlan0. – Michael Ehrenreich Sep 28 '14 at 21:29

Not the answer you're looking for? Browse other questions tagged or ask your own question.