Wireshark capture only packet from and to my PC when in promiscuous mode

Question

I've installed Wireshark and configured it to let my user run it with all needed privileges (I enabled dumpcap and added my user to wireshark group, then restarted).

Devices are shown and capture starts well. The problem is that only packets sent to and directed to the PC where Wireshark is running are captured. Obviously I enabled Promiscuous mode in the capture options dialog.

For example, if I run Wireshark and then surf the web on Firefox, packets are captured. If I start browsing with my smartphone, instead, no packet is captured (PC and smartphone are connected to the same domestic WiFi network).

I'm working with a WiFi device wlan0 with ath9k drivers. Here you are the output of ifconfig wlan0 and lspci | grep Wireless:

lorenzo@XUBUNTU:~$ ifconfig wlan0
wlan0     Link encap:Ethernet  HWaddr 5c:ac:4c:32:dc:1d  
          indirizzo inet:192.168.1.100  Bcast:192.168.1.255  Maschera:255.255.255.0
          indirizzo inet6: fe80::5eac:4cff:fe32:dc1d/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1585 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1782 errors:0 dropped:0 overruns:0 carrier:0
          collisioni:0 txqueuelen:1000 
          Byte RX:970355 (970.3 KB)  Byte TX:401610 (401.6 KB)

lorenzo@XUBUNTU:~$ lspci | grep Wireless
03:00.0 Network controller: Atheros Communications Inc. AR9287 Wireless Network Adapter (PCI-Express) (rev 01)

What I want to achieve is to examine the network traffic of my smartphone using my PC running Wireshark, both connected to the same personal domestic WiFi access point.

Please help me!!

Answer 1

This "problem" is related to the netwrok architecture (hardware). Routers these days are switches and not hubs, thus you see only traffic to your box.

You need to configure your network, there are several options, the wireshark guide goes through the issues quiet well.

http://wiki.wireshark.org/CaptureSetup/Ethernet

Personally I use a switch with a monitoring port, but you and add an additional router.

Sort of the bottom line is you need to configure your network to be able to monitor other clients.

Answer 2

When you're connected to a Network HUB via a CAT5 Cable, a network interface in promiscuous mode can see ALL the packets echoed by the HUB, not just the packets addressed to that NIC's IP address.

However, when you're "connected" wirelessly (wlan0) each device (laptop, cellphone) has its own radio connection with the wireless AP. The wireless AP doesn't echo (retransmit) other peoples data on your channel.

If your wireless device is capable of "monitor mode" (so it will receive packets on all wireless channels), you could use airmon-ng to set it.

Answer 3

Apparently, if you are trying to sniff a "protected" wifi network, many adapters will treat promiscuous mode the same as non-promiscuous mode, thus you will not see traffic from other wifi hosts. You'll need to switch to monitor mode to get all the traffic. I can't seem to find a reference or spec for why this is true though.

Reference: Wireshark's WLAN capture page