Wireshark · Wireshark-users: Re: [Wireshark-users] For Mark

[Steve Evans <sc_evans@xxxxxxxxx>]

You will need an adapter with a driver that supports promiscuous mode. 

3 PCAP adapters are necessary of you want to perform a simultaneous 3 channel trace (1, 6, 11) if you want to troubleshoot roaming issues.

/Steve



--- On Mon, 12/1/08, Faraz Hasan <farazhasan110@xxxxxxxxxxx> wrote:

> From: Faraz Hasan <farazhasan110@xxxxxxxxxxx>
> Subject: [Wireshark-users] For Mark
> To: wireshark-users@xxxxxxxxxxxxx
> Date: Monday, December 1, 2008, 11:54 AM
> I am sorry this is not a reply to your question but I am
> sure you can answer mine!
>  
> I am trying to capture wireless traffic 802.11 using
> wireshark. Is it only possible when I connect a certain
> wireless adaptor? I mean is it necessary to have AirPcap
> adaptor or just any other adaptor? Is it not possoble with
> just wireshark and WinPcap?
>  
> Faraz> Date: Sun, 30 Nov 2008 15:39:20 +0200> From:
> markryde@xxxxxxxxx> To: wireshark-users@xxxxxxxxxxxxx>
> Subject: [Wireshark-users] sniffing 802.11 wireless traffic
> (beacons)> > Hello,> > I have a question about
> sniffing 802.11 wireless traffic;> I am running
> wireshark-1.0.0-2 on Fedora Core.> I had set my wireless
> nic (ZD1211) to be in monitor mode;> iwconfig wlan0
> shows:> > wlan1 IEEE 802.11 Mode:Monitor
> Frequency:2.412 GHz Tx-Power=0 dBm> Retry min limit:7 RTS
> thr:off Fragment thr=2352 B> Encryption key:off> Link
> Quality:0 Signal level:0 Noise level:0> Rx invalid nwid:0
> Rx invalid crypt:0 Rx invalid frag:0> Tx excessive
> retries:0 Invalid misc:0 Missed beacon:0> > I had
> started sniffing with wireshark by selecting wlan1 in>
> capture->options (and also selecting> promiscuous
> mode).> I can sniff only probe requests packets. Any idea
> why I cannot see beacons from> an Access Point ? There is
> an Access Point near me to which I can> associate
> from> other machines near me (and also from my machine
> when changing to managed mode).> It seems strange to me,
> because I scan for more than 5 minutes and> no beacon
> fragments. (As far as I know, an access point sends usually
> 10> beacons per second, or more )> > What could be
> the reason? I simply don't believe that an Access Point
> does> not send beacons!> > Regards,> Mark>
> _______________________________________________>
> Wireshark-users mailing list>
> Wireshark-users@xxxxxxxxxxxxx>
> https://wireshark.org/mailman/listinfo/wireshark-users
> _________________________________________________________________
> News, entertainment and everything you care about at
> Live.com. Get it now!
> http://www.live.com/getstarted.aspx_______________________________________________
> Wireshark-users mailing list
> Wireshark-users@xxxxxxxxxxxxx
> https://wireshark.org/mailman/listinfo/wireshark-users