Results 1 to 5 of 5

Thread: Wireshark: WLAN must be in Managed or Monitor mode?

Hybrid View

  1. #1
    Junior Member lanwarrior's Avatar
    Join Date
    May 2008
    Posts
    39

    Default Wireshark: WLAN must be in Managed or Monitor mode?

    First, here's my setup:

    ASUS EEE 1000H
    WLAN Card (replaced the original): Gigabyte with Atheros chip
    OS: BackTrack 3 installed on SDHC, configured for persistent changes

    The WLAN card support packet injections, airodump, etc. Tested and can monitor and crack WEP/WPA.

    My question:

    My understanding is that to be able to sniff packet in promiscous mode, I have to enable the WLAN card (ath0) in MONITOR MODE. However, if I do that, I cannot join the wireless network which I tried to sniff. But once I changed ath0 to Managed mode, Wireshark doesn't capture in promiscous mode.

    What I want is to test connecting to my WLAN network and then run Wireshark.

  2. #2
    Senior Member ShadowKill's Avatar
    Join Date
    Dec 2007
    Posts
    908

    Default

    Well you can choose which device you want to use wireshark with so creating a monitor enabled VAP via the airmon-ng start blah command and choosing that within wireshark should enable you to utilize it while being connected to the network.... I may be wrong though as I haven't tried this.



    "The goal of every man should be to continue living even after he can no longer draw breath."

    ~ShadowKill

  3. #3
    Junior Member lanwarrior's Avatar
    Join Date
    May 2008
    Posts
    39

    Default

    I have enabled the WLAN card in Monitor mode (airmon-ng start wifi0) and this creates an new instance ath0.

    At this point, the WLAN card CANNOT join any wireless network because it's in Monitor mode.

    So if I start Wireshark, choose ath0, nothing will be captured because the WLAN card is not associated to any network.

    So I put the ah0 into Managed mode. Now I CAN join my wireless network. Start Wireshark, and promiscous mode does NOT work because the card is no longer in monitor mode. It can only see traffic from my machine only, that's it.

  4. #4
    Senior Member ShadowKill's Avatar
    Join Date
    Dec 2007
    Posts
    908

    Default

    Quote Originally Posted by lanwarrior View Post
    I have enabled the WLAN card in Monitor mode (airmon-ng start wifi0) and this creates an new instance ath0.

    At this point, the WLAN card CANNOT join any wireless network because it's in Monitor mode.

    So if I start Wireshark, choose ath0, nothing will be captured because the WLAN card is not associated to any network.

    So I put the ah0 into Managed mode. Now I CAN join my wireless network. Start Wireshark, and promiscous mode does NOT work because the card is no longer in monitor mode. It can only see traffic from my machine only, that's it.
    What I'm saying is have ath0 in Managed mode, run airmon-ng start ath0 which will create a VAP named ath1 which you can use within Wireshark while still connecting to a network with ath0



    "The goal of every man should be to continue living even after he can no longer draw breath."

    ~ShadowKill

  5. #5
    Junior Member
    Join Date
    Apr 2007
    Posts
    57

    Default

    I`m curious as to why you cannot see the traffic in promiscuous mode using wireshark?

    The steps i would take are:
    1) start airmon-ng using including the channel number / use kismet to lock the channel
    2) start wireshark with the correct wifi device
    3) if utilising encryption have wireshark decode by entering the key under the "protocols" section

    This way i would be locked onto the correct channel. If there is any other devices on the same channel that you dont want to monitor you can filter the traffic using the IP addresses or MAC addresses.

    In monitor mode you should be seeing everything on that wifi channel.

    If you want to be in a Managed mode then you might want to look at ettercap.

    link - http://forums.remote-exploit.org/sho...d.php?p=110418

    regards

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •