I'm connected to my WiFi network and I want to capture and analyze packets that other clients are exchanging with the gateway. I don't want to modify the content of these packets and I don't need to read the content of every packet.
Actually, the wlan configuration is the following:
- a router
192.168.1.1
- the laptop that I'm using to sniff traffic
192.168.1.9
- my smartphone
192.168.1.2
so I want to be able to see (part of) the traffic between my smartphone and the router.
To achieve the goal I set the wireless interface in promiscuous mode with sudo ip link wlo1 promiscuous on
and I check if it is enabled with netstat -i
:
Kernel Interface table
Iface MTU Met RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg
enp8s0 1500 0 28962 0 1 0 22923 0 0 0 BMU
lo 65536 0 7294 0 0 0 7294 0 0 0 LRU
wlo1 1500 0 29469 0 0 0 12236 0 0 0 BMPRU
The P
on the flag column indicates the promiscuous mode, so I'm assuming it is enabled. Since the promiscuous mode is on, I should see all the traffic that my NIC can capture. Then I open wireshark and I start to capture traffic on wlo1
interface but I don't see any packets from source 192.168.1.2
and I'm surfing the net with my smartphone (so, I'm generating traffic).
What am I doing wrong?