1

So here is my setup

  • Desktop booting a live version of Kali from a USB drive
  • The standard distro of wireshark that comes with Kali
  • A Ralink RT-3070L High gain antenna
  • My home network as a sandbox.

When I run wireshark (with my antenna in promiscuous mode) I only see a very small amount of packets from other machines.

I see everything from the machine I am on and I see some things coming from the router.

From my understanding this is indicative of running in Monitor mode. However, that's not what the settings are telling me and I know for a fact this antenna can work in promiscuous mode. Am I missing something?

7
  • What do you expect to see? Sep 27, 2014 at 16:41
  • I have a number of devices on my network. A Surface pro, lumia 920, xbox one, kindle.... I expect to see something other that my personal machines traffic. There is clearly something not configured correctly Sep 27, 2014 at 16:44
  • When you run iwconfig, what mode is the WLAN adapter in? Sep 27, 2014 at 16:48
  • When I run iqconfig it says it's in Managed mode Sep 27, 2014 at 16:51
  • 1
    Then its not in promiscuous(or Monitor) mode. Run something similar to airmon-ng start wlan0 to bring it to 'Monitor' mode. Substitute wlan0 with whatever is applicable on your desktop. Sep 27, 2014 at 16:55

1 Answer 1

2

Put your Wifi card in monitor mode by doing something similar to airmon-ng start wlan0. Then run Wireshark on that interface. You should be able to see some packets other than those meant for your desktop. However when you put it in monitor mode it constantly keeps hopping over the various channels. It'll only capture packets on the channel it is currently on. Hence if all your devices are on different channels, it'll be difficult to monitor all the packets in the air. You can have your access point to use only a specific channel, put the Wifi card on that specific channel(look at airmon-ng options), then sniff with Wireshark on that interface.

4
  • I restarted my live instance so I was starting from fresh. I connected to my wifi network. I opened terminal. I typed airmon-ng start wlan0 (because my wireless interface is wlan0) it said "(monitor mode enabled on mon0)" I opened wireshark and started listening on wlan0. All I see is arp requests. Sep 27, 2014 at 18:11
  • You need to make sure you tie all your devices, your access point and the WiFi card to the same channel Sep 27, 2014 at 18:15
  • This still produces the same results Sep 28, 2014 at 14:12
  • 1
    @AnthonyRussell Try listening on mon0 instead of wlan0. Sep 28, 2014 at 21:29

Not the answer you're looking for? Browse other questions tagged or ask your own question.