Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I've installed Wireshark and configured it to let my user run it with all needed privileges (I enabled dumpcap and added my user to wireshark group, then restarted).

Devices are shown and capture starts well. The problem is that only packets sent to and directed to the PC where Wireshark is running are captured. Obviously I enabled Promiscuous mode in the capture options dialog.

For example, if I run Wireshark and then surf the web on Firefox, packets are captured. If I start browsing with my smartphone, instead, no packet is captured (PC and smartphone are connected to the same domestic WiFi network).

I'm working with a WiFi device wlan0 with ath9k drivers. Here you are the output of ifconfig wlan0 and lspci | grep Wireless:

lorenzo@XUBUNTU:~$ ifconfig wlan0
wlan0     Link encap:Ethernet  HWaddr 5c:ac:4c:32:dc:1d  
          indirizzo inet:192.168.1.100  Bcast:192.168.1.255  Maschera:255.255.255.0
          indirizzo inet6: fe80::5eac:4cff:fe32:dc1d/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1585 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1782 errors:0 dropped:0 overruns:0 carrier:0
          collisioni:0 txqueuelen:1000 
          Byte RX:970355 (970.3 KB)  Byte TX:401610 (401.6 KB)

lorenzo@XUBUNTU:~$ lspci | grep Wireless
03:00.0 Network controller: Atheros Communications Inc. AR9287 Wireless Network Adapter (PCI-Express) (rev 01)

What I want to achieve is to examine the network traffic of my smartphone using my PC running Wireshark, both connected to the same personal domestic WiFi access point.

Please help me!!

share|improve this question
add comment

2 Answers

up vote 3 down vote accepted

This "problem" is related to the netwrok architecture (hardware). Routers these days are switches and not hubs, thus you see only traffic to your box.

You need to configure your network, there are several options, the wireshark guide goes through the issues quiet well.

http://wiki.wireshark.org/CaptureSetup/Ethernet

Personally I use a switch with a monitoring port, but you and add an additional router.

Sort of the bottom line is you need to configure your network to be able to monitor other clients.

share|improve this answer
    
I'm in a WiFi network. No hub nor switches. –  lorenzo-s Dec 27 '11 at 20:08
    
Look at wiki.wireshark.org/CaptureSetup/WLAN –  bodhi.zazen Dec 27 '11 at 20:12
add comment

When you're connected to a Network HUB via a CAT5 Cable, a network interface in promiscuous mode can see ALL the packets echoed by the HUB, not just the packets addressed to that NIC's IP address.

However, when you're "connected" wirelessly (wlan0) each device (laptop, cellphone) has its own radio connection with the wireless AP. The wireless AP doesn't echo (retransmit) other peoples data on your channel.

If your wireless device is capable of "monitor mode" (so it will receive packets on all wireless channels), you could use airmon-ng to set it.

share|improve this answer
    
I can enable monitor mode only via console using ifconfig wlan0 down; iwconfig wlan0 mode monitor; ifconfig wlan0 up. Then using Wireshark I can see traffic from all visible WiFi access points! But that's not what I want. Additionally, this method don't let me connect to my own network until I switch back to iwconfig wlan0 mode managed. –  lorenzo-s Dec 27 '11 at 20:14
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.