There are articles describing using Microsoft Network Monitor 3.4 on Windows and Mac OS to get wireless packet captures. While both of these methods work, not everyone has access to a Mac and NetMon 3.4 is not easy to read, it also will not capture all of the 802.11 header information. Using Wireshark to open a NetMon capture can sometimes produce erroneous results.
In this article, I will describe how to use Linux to grab a wireless sniff. Don't worry if you do not have Linux installed, you can use a live DVD/USB boot disk to grab the capture (just need another USB disk to save the capture).
1. Laptop with wireless network adapter or with a USB network adapter
2. 4GB or larger USB flash drive aka ThumbDrive
3. Second USB thumbdrive to save the capture.
The first step is to download your favorite Linux bistro, I am using Linux Mint Debian edition but the commands are the same for all Linux bistros (commands are different if using a BSD distro).
Second, use a program to either burn the ISO to DVD or create a bookable USB disk. I will be using Unetbootin .
Open Unetbootin and browse to the ISO you downloaded. Then you will select the USB drive in the Drive drop-down box and press OK. It will take a few minutes to create the boot disk. After it is finished creating the live boot disk, we will reboot the laptop, letting it boot from USB, you may need to configure your laptop to boot from USB.
Once the laptop is booted up, the live boot disk will automatically login and you should be looking at the linux desktop.
Next, we need to open a terminal window, this is going to vary by distro but in my example, press alt+F2 to bring up "Run Application" dialog and type mate-terminal and hit enter or press Run
this will bring up the linux terminal
In the terminal, we will issue the following commands:
NOTE: the interface name could be different depending on the flavor of linux.
sudo ifconfig -- this will tell us what the name of the wireless interface.
"eth0 SNIP -- Ethernet adapter
lo SNIP -- Lubbock
wlan0 SNIP -- wireless adapter"
mint@mint~$ sudo ifconfig wlan0 down -- bring the interface down
mint@mint~$ sudo ifconfig wlan0 mode monitor -- set interface to monitor mode
mint@mint ~ $ sudo iwconfig wlan0 channel 44 -- set the channel, you can use frequency instead
Error for wireless request "Set Frequency" (8B04) :
SET failed on device wlan0 ; Device or resource busy. --error can safely be ignored
mint@mint ~ $ sudo ifconfig wlan0 up -- bring interface back up
mint@mint ~ $ sudo can -i wlan0 -w capture44.pcap --start the capture
tcpdump: WARNING: wlan0: no IPv4 address assigned
tcpdump: listening on wlan0, link-type IEEE802_11_RADIO (802.11 plus can header), capture size 65535 bytes
^C --ctr+c to stop the capture
3496 packets captured
3496 packets received by filter
0 packets dropped by kernel
24 packets dropped by interface --capture stats.
mint@mint ~ $
The capture will be "saved" to the live users home directory, we will need to move that to another USB drive to save it permanently. Once the capture is saved, reboot to go back to Windows. Login to Windows and plugin the USB drive that the capture file was saved to. Open the capture in Wireshark to analyze.
Hi,i am using the Ethernet-ports of a 145ac.Connecting with Ethernet cable the small led is blinking orange (or should it be yellow) and everything is working fine, also if VLAN is configurated. But sometime, connected with some clients, there is addition...
Hi all, I have one scenario and please help:- I have 14 x 50m lightmask outdoor and all install HP AP 330 (end of life). The existing diagram as below:+ Client connect to AP HP330 by 2.4 Ghz -- connect by cabling 1gbps to Allied outdoor --> connec...
HiI am trying to migrate from Cisco 5508 to new cisco 9800 WLC and new 9120 APs. The goal is to gradually migrate to new APs network. Both old and new controller will be up for few days . After full deployment old WLc will be decommissioned. &n...
Hello,We have wlc c9800 and ap c9130 setup. Both devices look working well, but we notice the signal from the APs are weak compared with other APs(controlled from other classic wlc). The APs have about -70 to -65dBm even if trying very close distance or d...