I see some other random messages from other devices.Ĭuriously, with ifconfig wlp3s0, I see the board is NOT in promiscuous mode once Wireshark is started. With all of them, I don't see all packets and it looks they fail to enter promiscuous mode: once I see the very first ARP-RQ, I don't see anything else between the two devices. I tried: Intel Link 5100 AGN Linksys Wireless-G Qualcomm Atheros AR928X Can you confirm promiscuous mode is NOT what I need? Yes, I red carefully (I hope) 'WLAN (IEEE 802.11) capture setup' paragrph, but I am confused: I don't need to capture radio-level, I don't need to capture all SSID's but I need to see packets not directed to me. I do't need to trace at radio level, but I just need (want!) to see from Ethernet level, so I guess I simply need a WiFi card/adapter/dongle able to accept 'promiscuous' mode. Use promiscous mode only as backup.įurthermore, some wirelesse driver/hardware allows your device to send completely arbitrary packets while in monitor mode - this is called packet injection.Hello, I need to trace between two WiFi devices, connected to the same A.P. If the tool you want to use supports monitor mode, use it. So monitor mode is advantageous if you want to really see what's going on, while promiscous mode is there for compatibility with standard ethernet network sniffing tools that can't handle the extended 802.11 frame format. Only special wireless monitoring software is able to process packets in the format dumped by the driver in monitor mode. In 'monitor mode', you capture packets from all the networks operating on a chosen channel (possibly even adjacent channels - there is a reason that 802.11 DSSS beacons contain the channel number in the payload), and the driver does not output plain ethernet, but needs to output more headers (there are 3 addresses in a 802.11 header, instead of just 2 addresses in the 802.3 ethernet headers). Possibly the device will only dump packets from the AP to wireless devices, but not packets from wireless clients to the AP, as receiving packets from non-AP devices is not used in AP client mode. In 'Promiscous mode', the driver still outputs standard ethernet frames belonging to the one wireless network you are currently associated to (identified by the BSSID).

Wireshark promiscuous mode wifi