I have read a lot of Q&As that have achieved success in packet captures of Wifi probe requests, which entails capturing
IEEE802_11_RADIO (802.11 plus radiotap header) in monitor mode. But I find that I cannot capture any packets at all in monitor mode (though I have no trouble with packet captures in managed mode on a network). I'm sitting right next to my iPhone, on which I am streaming video and sometimes checking for the presence of additional wireless networks.
Shouldn't I at least be picking up on beacons from APs? Can anyone suggest what my roadblock might be?
I've set my wireless card to monitor mode, then run tcpdump:
ifconfig wlan0 down iwconfig wlan0 mode monitor ifconfig wlan0 up tcpdump -fni wlan0 # TCPDUMP
I've also tried using
airmon-ng to create a new device on which to attempt a capture:
stop network-manager # AIRMON-NG WARNS THAT THIS COULD CAUSE PROBLEMS IF NOT KILLED service avahi-daemon stop # AIRMON-NG WARNS THAT THIS COULD CAUSE PROBLEMS IF NOT KILLED killall wpa_supplicant # AIRMON-NG WARNS THAT THIS COULD CAUSE PROBLEMS IF NOT KILLED airmon-ng start wlan0 # AIRMON-NG tcpdump -fni mon0 # TCPDUMP
In the block of commands above,
airmon-ng outputs the following:
Interface Chipset Driver wlan0 Unknown iwlwifi - [phy0] (monitor mode enabled on mon0)
tcpdump consistently outputs the following and then nothing (no captures):
tcpdump: WARNING: mon0: no IPv4 address assigned tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on mon0, link-type IEEE802_11_RADIO (802.11 plus radiotap header), capture size 65535 bytes
tcpdump version 4.5.1
libpcap version 1.5.3
Ubuntu 14.04 LTS
I've also tried
airodump-ng in order to scan channels 1-12.
As for my hardware,
03:00.0 Network controller: Intel Corporation Wireless 7260 (rev 83) Subsystem: Intel Corporation Dual Band Wireless-AC 7260 Flags: bus master, fast devsel, latency 0, IRQ 64 Memory at f0400000 (64-bit, non-prefetchable) [size=8K] Capabilities: [c8] Power Management version 3 Capabilities: [d0] MSI: Enable+ Count=1/1 Maskable- 64bit+ Capabilities:  Express Endpoint, MSI 00 Capabilities:  Advanced Error Reporting Capabilities:  Device Serial Number e8-b1-fc-ff-ff-e8-fa-80 Capabilities: [14c] Latency Tolerance Reporting Capabilities:  Vendor Specific Information: ID=cafe Rev=1 Len=014 <?> Kernel driver in use: iwlwifi