4

I've got a non-PC wireless client, and I'm wondering about some of its connections. I want to see the actual packets being exchanged from the net to my device over a Wi-Fi connection.

I have Wireshark running on a PC and am watching traffic go by on the network, but whenever the device loads information from the net, it doesn't show up on the sniffer. I have it set to promiscuous mode, but still nothing.

Does anyone know how to make something be seen by a packet sniffer?

Spiff
  • 101,729
  • 17
  • 175
  • 229
Nicholas Stuart
  • 41
  • 1
  • 2
  • Wireshark only shows you your traffic on your computer, not your network. Doing it network wide requires a special setting on the router which doesn't normally exist – TheLQ Aug 24 '10 at 03:11
  • Okay, so I can't mod my router to help show traffic on the network, what about setting linux up as a router. I'd enable wifi on the device, then setup a linux box as a DHCP server, set it up as a "gateway" and all IP_Forwarding, would this all that linux box to view the packets passing through? – Nicholas Stuart Aug 24 '10 at 03:26
  • Yes, that would work. You just need the router to be between the wireless interface and the Internet. – Karl Bielefeldt Aug 24 '10 at 04:12
  • 4
    @Lord.Quackstar grossly oversimplified. Sniffers like Wireshark can put your interface into promiscuous mode, so it sees all traffic on your hub, regardless of address. If you're on a switch, you won't see others' unicast traffic, but you'll still see their multicast/broadcast traffic. If you have a manageable switch (no router needed) you can enable port mirroring so another port's traffic gets copied to your sniffer's port so you can see it. 802.11 monitor mode sniffers even can see all traffic on an entire 802.11 channel, regardless of which wireless AP / network it is on. – Spiff Aug 24 '10 at 04:41
  • 1
    To whoever voted to close: This not off-topic at all. This is a PC network sniffing / Wireshark question, nothing really Android-specific about it at all. – Spiff Aug 24 '10 at 04:47
  • @Spiff and a Router would qualify as a "switch", so the unicast info isn't being seen by every host. So would putting the gateway as a linux machine with IP_FORWARD enabled work? – Nicholas Stuart Aug 24 '10 at 05:14
  • @Spiff And please tell me how many consumer grade routers/switches let you setup a "sniffer port" or forced global rebroadcasting? – TheLQ Aug 25 '10 at 23:19
  • 1
    @Lord.Quackstar, your question seems like a non-sequitur. I took issue with the first 23 words of your comment, not the last 4. – Spiff Aug 26 '10 at 01:59

3 Answers3

5

That's all way too hard if you're using Linux. Most wireless cards nowadays support monitor mode, which allows to use them to capture all packets, including 802.11 Management and Control frames, on a single channel.

If your wireless card supports this mode (chances that it does), then do the following (I assume that you are using a Debian-based distro:

$ sudo su
# aptitude install aircrack-ng
# airmon-ng start wlan0
# airodump-ng mon0

At this point, you should see a list of wireless networks and connected clients. Note the channel number on which your network/client is running. You'll need it to lock your NIC on a particular channel: now it switches all channels sequently to detect every network.

^C
# airodump-ng mon0 -c $channel

You don't really need any of airodump-ng output, it is just used to set channel. Also you can use iw/iwconfig to use it or just connect to the network (yes, you can simultaneously be connected to a network and use monitor mode), but this is easiest and error-prone way.

Now you can start Wireshark and point it to mon0 interface. You'll be able to see all packets travelling through your network. If you want to see only data packets, use this filter: wlan.fc.type_subtype == 0x20.

As a note, I want to say that this is probably possible on Windows, but is harder and range of supported adapters is much narrower, as there are no standard API for monitor mode in Windows.

Catherine
  • 16,103
  • 5
  • 46
  • 55
0

I've run into this as well. I have a managed switch inside my wired/wireless router, mirroring all traffic to a sensor port that I route into a secondary NIC on my main PC, which allows me to see basically all traffic, except wireless. One solution I'm considering is to add another managed switch (they're surprisingly cheap these days) outside the router, between the modem and the router, which will allow me to capture the wireless traffic. There's just one problem: it will also see a ton of useless traffic from the Internet that is otherwise ignored by the router and which I don't usually see at all. I'm not sure if this qualifies as an answer, but I'm definitely interested in what everyone else has to add on this topic.

boot13
  • 5,819
  • 3
  • 28
  • 42
0

Depending on what you are looking for - ARP poisoning might be the solution. That way you could capture the packets and examine them... They will be a little bit different than original ones (IP headers will have your computers IP as incoming/outgoing depending on if they are going out or into your network, but it does not matter... packets will stay the same and you'll be able to recognize what you need).

check arpspoof and/or ettercap

tkit
  • 632
  • 5
  • 14