Results 1 to 9 of 9

Thread: Open network but can't capture a single packet - any idea why?

  1. #1
    Just burned his ISO
    Join Date
    Nov 2010
    Posts
    3

    Default Open network but can't capture a single packet - any idea why?

    Re,

    I have no problem capturing packets on various wireless hotspots but there are a couple in my town that I just cannot understand why no packets are visible. These are "open" networks (i.e., no WEP/WPA/etc. protection) where you obtain a username/password from the administrator, connect and then open internal page to log in using those credentials. Only then you get access to the Internet.

    Here is what the traffic looks like: http://img821.imageshack.us/img821/3195/snapshot2d.png

    Could someone please guide me in the right direction as to how to "decrypt" the traffic? If there's no encryption, why don't I see anything?

    Thanks!

  2. #2
    Member macphail's Avatar
    Join Date
    Jun 2010
    Location
    East Coast, USA
    Posts
    164

    Default Re: Open network but can't capture a single packet - any idea why?

    so, if i understand you correctly (and I believe that I do), you are attempting to sniff the traffic in order to retrieve the username and password supplied by the hotspot vendor? i assume so that you can circumnavigate actually having to be granted access from them? does that pretty much sum it up?

    ...wait for it... wait for it...
    -----------
    ~peace
    MacPhail

  3. #3
    Just burned his ISO
    Join Date
    Nov 2010
    Posts
    3

    Default Re: Open network but can't capture a single packet - any idea why?

    no. I want to monitor the traffic that's not only directed to/initiated from my IP when I am connected to that network. I also have the login credentials, so I can access Internet through that network. yes, the adapter is in managed mode and Wireshark is capturing in promiscuous mode as well. like I said, I have no problem "sniffing" traffic from regular WEP hotspots and/or WPA encrypted ones, provided that I know the key. it's just for some reason on these otherwise non-encrypted networks I do not see any traffic other than to/from myself.

  4. #4
    Good friend of the forums gunrunr's Avatar
    Join Date
    Jan 2010
    Location
    shining my spoon
    Posts
    265

    Default Re: Open network but can't capture a single packet - any idea why?

    are you making traffic? if you want to test this idea ping the ap, or pull up a webpage and you should see the syn-ack and get requests
    cause broadcast beacons are not really traffic in my book they do not contain data just a header
    Wielder of the spoon of doom
    Summercon, Toorcon, Defcon, Bsides, Derbycon, Shmoocon oh my
    Come hang out with hackers on twitter @gunrunr556

  5. #5
    Senior Member Thorn's Avatar
    Join Date
    Jan 2010
    Location
    The Green Dome
    Posts
    1,509

    Default Re: Open network but can't capture a single packet - any idea why?

    Sounds like a wireless VLAN.
    Thorn
    Stop the TSA now! Boycott the airlines.

  6. #6
    Good friend of the forums gunrunr's Avatar
    Join Date
    Jan 2010
    Location
    shining my spoon
    Posts
    265

    Default Re: Open network but can't capture a single packet - any idea why?

    if you look real good at his linked jpeg, it says "mon0 capturing-wireshark" if he's on mon0 than he's not connected the the ap anyways because he's in monitor mode.
    Wielder of the spoon of doom
    Summercon, Toorcon, Defcon, Bsides, Derbycon, Shmoocon oh my
    Come hang out with hackers on twitter @gunrunr556

  7. #7
    Just burned his ISO
    Join Date
    Nov 2010
    Posts
    3

    Default Re: Open network but can't capture a single packet - any idea why?

    gunrunr: mon0 is in monitor, wlan0 is not. if I recall correctly, I was connected when I took the screenshot. I specifically didn't generate any traffic since I could see it being captured. however, other than my traffic there were only those beacon packets.

    I'll try going back today to test again but I recall that even when booting into Windows to test ARP spoofing with Cain, it could not detect a single other MAC address on the network.

  8. #8
    Senior Member Thorn's Avatar
    Join Date
    Jan 2010
    Location
    The Green Dome
    Posts
    1,509

    Default Re: Open network but can't capture a single packet - any idea why?

    Quote Originally Posted by gunrunr View Post
    if you look real good at his linked jpeg, it says "mon0 capturing-wireshark" if he's on mon0 than he's not connected the the ap anyways because he's in monitor mode.
    Then as they say on MythBusters; "Well, THERE'S your problem!"
    Thorn
    Stop the TSA now! Boycott the airlines.

  9. #9
    Super Moderator Archangel-Amael's Avatar
    Join Date
    Jan 2010
    Location
    Somewhere
    Posts
    8,012

    Default Re: Open network but can't capture a single packet - any idea why?

    Quote Originally Posted by Thorn View Post
    Then as they say on MythBusters; "Well, THERE'S your problem!"
    nodoudt
    To be successful here you should read all of the following.
    ForumRules
    ForumFAQ
    If you are new to Back|Track
    Back|Track Wiki
    Failure to do so will probably get your threads deleted or worse.

Similar Threads

  1. vmware player and Packet Capture
    By Hadeshorn in forum Beginners Forum
    Replies: 4
    Last Post: 01-29-2010, 10:58 PM
  2. Replies: 7
    Last Post: 05-28-2009, 03:59 AM
  3. Eee PC 701SD and packet capture
    By Deegs in forum OLD Newbie Area
    Replies: 3
    Last Post: 02-05-2009, 03:31 AM
  4. Single packet port knocking with Fwknop
    By compaq in forum OLD Newbie Area
    Replies: 1
    Last Post: 08-03-2008, 11:39 AM
  5. packet capture decompile apps
    By imported_spudgunman in forum OLD BT3beta General
    Replies: 7
    Last Post: 12-27-2007, 08:07 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •