2

I have read a lot of Q&As that have achieved success in packet captures of Wifi probe requests, which entails capturing IEEE802_11_RADIO (802.11 plus radiotap header) in monitor mode. But I find that I cannot capture any packets at all in monitor mode (though I have no trouble with packet captures in managed mode on a network). I'm sitting right next to my iPhone, on which I am streaming video and sometimes checking for the presence of additional wireless networks.

Shouldn't I at least be picking up on beacons from APs? Can anyone suggest what my roadblock might be?

I've set my wireless card to monitor mode, then run tcpdump:

ifconfig wlan0 down
iwconfig wlan0 mode monitor
ifconfig wlan0 up
tcpdump -fni wlan0              # TCPDUMP

I've also tried using airmon-ng to create a new device on which to attempt a capture:

stop network-manager            # AIRMON-NG WARNS THAT THIS COULD CAUSE PROBLEMS IF NOT KILLED
service avahi-daemon stop       # AIRMON-NG WARNS THAT THIS COULD CAUSE PROBLEMS IF NOT KILLED
killall wpa_supplicant          # AIRMON-NG WARNS THAT THIS COULD CAUSE PROBLEMS IF NOT KILLED
airmon-ng start wlan0           # AIRMON-NG
tcpdump -fni mon0               # TCPDUMP

In the block of commands above, airmon-ng outputs the following:

Interface   Chipset     Driver

wlan0       Unknown     iwlwifi - [phy0]
                (monitor mode enabled on mon0)

tcpdump consistently outputs the following and then nothing (no captures):

tcpdump: WARNING: mon0: no IPv4 address assigned
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on mon0, link-type IEEE802_11_RADIO (802.11 plus radiotap header), capture size 65535 bytes

I'm running:
tcpdump version 4.5.1
libpcap version 1.5.3
Ubuntu 14.04 LTS

I've also tried airodump-ng in order to scan channels 1-12.

As for my hardware, lspci ouputs:

03:00.0 Network controller: Intel Corporation Wireless 7260 (rev 83)
    Subsystem: Intel Corporation Dual Band Wireless-AC 7260
    Flags: bus master, fast devsel, latency 0, IRQ 64
    Memory at f0400000 (64-bit, non-prefetchable) [size=8K]
    Capabilities: [c8] Power Management version 3
    Capabilities: [d0] MSI: Enable+ Count=1/1 Maskable- 64bit+
    Capabilities: [40] Express Endpoint, MSI 00
    Capabilities: [100] Advanced Error Reporting
    Capabilities: [140] Device Serial Number e8-b1-fc-ff-ff-e8-fa-80
    Capabilities: [14c] Latency Tolerance Reporting
    Capabilities: [154] Vendor Specific Information: ID=cafe Rev=1 Len=014 <?>
    Kernel driver in use: iwlwifi
  • Have you installed appropriate drivers for your WiFi chipset? Sometimes, raw packet capture requires the correct drivers, e.g. Realtek, to be installed. – Herringbone Cat Jul 24 '15 at 19:10
  • @Herringbone_Cat, I believe so. According to wikidevi.com/wiki/Iwlwifi, the iwlwifi driver supports monitor mode and my hardware (Intel Corporation Dual Band Wireless-AC 7260). Do you have any advice for confirming/disconfirming this? – JellicleCat Jul 24 '15 at 23:19
  • Looking up the chipset at linux-wless.passys.nl/query_part.php?brandname=Intel reveals 802.11a/b/g/n/ac 7260ac rev. 83 man: 8086 dev:08b2 Mini-PCIe Intel iwlwifi – JellicleCat Jul 24 '15 at 23:28
  • 1
    I can confirm your chipset is compatible with Linux. One do not even need to check linked pages to confirm this: wouldn't it be the case you would have no wlan0 interface in your system. Another think is to know if your chipset is compatible with Aircrack-ng, this can be [checked here](www.aircrack-ng.org/doku.php?id=compatibility_drivers). I do not know if this page is fully up-to-date (last change end-2013), however you will quickly see that for an hassle free experience you are likely encouraged to turn yourself toward Atheros chipsets. – WhiteWinterWolf Jul 25 '15 at 13:47
2

tcpdump will dump all IP packets captured from the network you are currently connected to. According to your explanation and elements, you've made the interface be up but you haven't connected to any Wi-Fi network: no network, no network packet to capture, so no tcpdump output, it's all simple as that.

You must first connect to an Access Point, then you can examine IP activity of other devices connected to the same Access Point as you.

At last, do not confuse tcpdump which will capture clear Network layer packets, with lower-level and wifi dedicated tools like airodump-ng which will allow to capture raw "Wifi" frames as they go on the air (ie. mostly ciphered). However, not all wifi adapters allow this (the chipset being classified as "Unknown" by airmon-ng leaves me quite pessimistic about yours...). It is frequent even on devices already equipped with an internal Wifi adapter (laptops, etc.) to use another external one, generally USB, for Wifi security testing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.