I've installed Wireshark and configured it to let my user run it with all needed privileges (I enabled dumpcap and added my user to wireshark group, then restarted).

Devices are shown and capture starts well. The problem is that only packets sent to and directed to the PC where Wireshark is running are captured. Obviously I enabled Promiscuous mode in the capture options dialog.

For example, if I run Wireshark and then surf the web on Firefox, packets are captured. If I start browsing with my smartphone, instead, no packet is captured (PC and smartphone are connected to the same domestic WiFi network).

I'm working with a WiFi device wlan0 with ath9k drivers. Here you are the output of ifconfig wlan0 and lspci | grep Wireless:

lorenzo@XUBUNTU:~$ ifconfig wlan0
wlan0     Link encap:Ethernet  HWaddr 5c:ac:4c:32:dc:1d  
          indirizzo inet:  Bcast:  Maschera:
          indirizzo inet6: fe80::5eac:4cff:fe32:dc1d/64 Scope:Link
          RX packets:1585 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1782 errors:0 dropped:0 overruns:0 carrier:0
          collisioni:0 txqueuelen:1000 
          Byte RX:970355 (970.3 KB)  Byte TX:401610 (401.6 KB)

lorenzo@XUBUNTU:~$ lspci | grep Wireless
03:00.0 Network controller: Atheros Communications Inc. AR9287 Wireless Network Adapter (PCI-Express) (rev 01)

What I want to achieve is to examine the network traffic of my smartphone using my PC running Wireshark, both connected to the same personal domestic WiFi access point.

Please help me!!

3 Answers 3


This "problem" is related to the netwrok architecture (hardware). Routers these days are switches and not hubs, thus you see only traffic to your box.

You need to configure your network, there are several options, the wireshark guide goes through the issues quiet well.


Personally I use a switch with a monitoring port, but you and add an additional router.

Sort of the bottom line is you need to configure your network to be able to monitor other clients.


When you're connected to a Network HUB via a CAT5 Cable, a network interface in promiscuous mode can see ALL the packets echoed by the HUB, not just the packets addressed to that NIC's IP address.

However, when you're "connected" wirelessly (wlan0) each device (laptop, cellphone) has its own radio connection with the wireless AP. The wireless AP doesn't echo (retransmit) other peoples data on your channel.

If your wireless device is capable of "monitor mode" (so it will receive packets on all wireless channels), you could use airmon-ng to set it.

  • I can enable monitor mode only via console using ifconfig wlan0 down; iwconfig wlan0 mode monitor; ifconfig wlan0 up. Then using Wireshark I can see traffic from all visible WiFi access points! But that's not what I want. Additionally, this method don't let me connect to my own network until I switch back to iwconfig wlan0 mode managed.
    – lorenzo-s
    Dec 27, 2011 at 20:14

Apparently, if you are trying to sniff a "protected" wifi network, many adapters will treat promiscuous mode the same as non-promiscuous mode, thus you will not see traffic from other wifi hosts. You'll need to switch to monitor mode to get all the traffic. I can't seem to find a reference or spec for why this is true though.

Reference: Wireshark's WLAN capture page

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.