1

I recently started using airodump-ng to monitor nearby WLAN network packets. I noticed it was picking up a WPA signal with almost perfect signal strength. I then noticed ifconfig was reporting transmissions. It seemed to me airomon and/or airodump was retransmitting everything it was receiving, as the amount of data being received was the amount of date being sent. I have since started manually setting up my wireless card, and am using wireshark to read from the device:

iw wlan0 set monitor none && \
ifconfig wlan0 up && \
iw reg set 00 && \
iw dev wlan0 set txpower fixed 0 && \
wireshark -i wlan0 -k -s 0 -w /root/cap/name_me.pcap

I believe the original commands were something simple like:

airmon-ng check kill
airmon-ng wlan0 start
airodump-ng wlan0mon -w output.pcap

This setup does not transmit, and any transmissions i make accidentally shouldn't get very far. How was I misusing Aircrack-ng?

2

Sounds like you were looking at the loopback (lo) interface. Without the output from your ifconfig command, it's impossible for us to tell.

One thing you may want to do before running airmon-ng start is

airmon-ng check kill

This terminates any network programs that might interfere with airmon-ng/airodump-ng. You are right though, nothing should be transmitted.

  • You're right, and now that I see that command I explicitly remember using it. I have updated my question to reflect that failure of my recollection. – motoku Sep 4 '15 at 0:19
  • You ignored the first part of my answer though. It sounds like you are looking at the local loopback interface (lo), not the wifi adapter. Provide the output of your ifconfig and highlight the "leak" – redwards510 Sep 8 '15 at 21:34
  • I discovered some broadcasts inaccurately report a -1 signal strength; so the WPA network was probably not coming from my card. I also discovered an option within iw that tells your card to ACK everything it receives. I could not find a way a loopback interface can pipe through my wlan0mon interface; and I was not able to replicate the events described here. – motoku Sep 9 '15 at 3:47
  • I will accept your answer because I shouldn't be running my computer for very long ever since my laptop fan quit working. It would be super neat if you would add any deductions obtained from this information to your answer. – motoku Sep 9 '15 at 3:53
  • I'm afraid I can't speculate on your issue without more detail. I can tell you that the -1 issue with airodump-ng is well known. Just google around for it. – redwards510 Sep 9 '15 at 17:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.