Tips on wireless sniffing

Have a question or want to start a discussion? Post it! No Registration Necessary.  Now with pictures!

Threaded View
We posted some new articles on, on the subject of getting a wireless
packet capture.  The main focus is to help Cisco customers collect captures so
that we can troubleshoot their problems, but these tips may be generally useful.

Please let me know if you see any errors.


Re: Tips on wireless sniffing
On 10/26/2011 12:29 PM, Aaron Leonard wrote:
Quoted text here. Click to load it

Technically, isn't a packet sniffer strictly passive? If so, then the
comment about the sniffer using a transmitter doesn't make sense.

No mention of wireshark. Is netmon better?

Re: Tips on wireless sniffing
Quoted text here. Click to load it


If you're referring to 1) in -
then that's not quite what it says there.  Maybe we could word it better.

Quoted text here. Click to load it

OK, let's break this down ...

* Wireshark actually works well in Mac OS X 10.7 to do a wireless sniff, and in
fact our doc gives some examples

* Wireshark also can be used in Linux to do a wireless sniff ... we decided not
to document anything in this area however, because there are so many variants of
Linux, not to mention driver issues.

* With Windows, however, Wireshark normally *can't* do a wireless sniff.  The
exception is with the AirPcap adapters from Riverbed (nee CACE).  (It would be
ideal if Wireshark could be enhanced to hook into the Windows 7 driver API for
promiscuous wireless ... but on the other hand, as Riverbed is a sponsor of
Wireshark's ...)

Thus, when it comes to "free" wireless sniffing in Windows 7, Netmon is the only
game in town.  I'm not too thrilled about the user interface, but it does
usually work pretty well (modulo whatever the capabilities of the underlying
adapter may provide.)

Thanks for the feedback.


Re: Tips on wireless sniffing

Quoted text here. Click to load it

"Note that, even though Netmon 3.4 is supported with XP SP3 and Vista,
it supports wireless sniffing only if running Windows 7."

Netmon (3.4) does monitor mode wireless sniffing fine in (64-bit) Vista
on my Macbook early 2009 with the Apple driver from Boot Camp. Wirelss
card is Broadcom BCM43xx 1.0 ( - as seen in System Profiler
in OS X 10.5.8.

Not him on Facebook

Re: Tips on wireless sniffing
Quoted text here. Click to load it

Thanks Axel; I've updated the article accordingly.

Btw, Netmon 3.4 also captures some interesting wireless packets when
used in non-promiscuous mode, on an adapter in production use.  At
least on my Intel 6300, I get to see some beacons and
probe/authentication/association responses from the AP (although
not the probe/authentication/association requests that I'm sending out.)

(Writing that up is on the to-do list.)



Site Timeline