Wireshark: WLAN must be in Managed or Monitor mode?
First, here's my setup:
ASUS EEE 1000H
WLAN Card (replaced the original): Gigabyte with Atheros chip
OS: BackTrack 3 installed on SDHC, configured for persistent changes
The WLAN card support packet injections, airodump, etc. Tested and can monitor and crack WEP/WPA.
My question:
My understanding is that to be able to sniff packet in promiscous mode, I have to enable the WLAN card (ath0) in MONITOR MODE. However, if I do that, I cannot join the wireless network which I tried to sniff. But once I changed ath0 to Managed mode, Wireshark doesn't capture in promiscous mode.
What I want is to test connecting to my WLAN network and then run Wireshark.
Well you can choose which device you want to use wireshark with so creating a monitor enabled VAP via the airmon-ng start blah command and choosing that within wireshark should enable you to utilize it while being connected to the network.... I may be wrong though as I haven't tried this.
"The goal of every man should be to continue living even after he can no longer draw breath."
~ShadowKill
I have enabled the WLAN card in Monitor mode (airmon-ng start wifi0) and this creates an new instance ath0.
At this point, the WLAN card CANNOT join any wireless network because it's in Monitor mode.
So if I start Wireshark, choose ath0, nothing will be captured because the WLAN card is not associated to any network.
So I put the ah0 into Managed mode. Now I CAN join my wireless network. Start Wireshark, and promiscous mode does NOT work because the card is no longer in monitor mode. It can only see traffic from my machine only, that's it.
What I'm saying is have ath0 in Managed mode, run airmon-ng start ath0 which will create a VAP named ath1 which you can use within Wireshark while still connecting to a network with ath0Originally Posted by lanwarrior
"The goal of every man should be to continue living even after he can no longer draw breath."
~ShadowKill
I`m curious as to why you cannot see the traffic in promiscuous mode using wireshark?
The steps i would take are:
1) start airmon-ng using including the channel number / use kismet to lock the channel
2) start wireshark with the correct wifi device
3) if utilising encryption have wireshark decode by entering the key under the "protocols" section
This way i would be locked onto the correct channel. If there is any other devices on the same channel that you dont want to monitor you can filter the traffic using the IP addresses or MAC addresses.
In monitor mode you should be seeing everything on that wifi channel.
If you want to be in a Managed mode then you might want to look at ettercap.
link - http://forums.remote-exploit.org/sho...d.php?p=110418
regards
Posting Permissions
