1. Home
  2. Wireless Networking
  3. Tips on wireless sniffing

Tips on wireless sniffing

We posted some new articles on cisco.com, on the subject of getting a wireless packet capture. The main focus is to help Cisco customers collect captures so that we can troubleshoot their problems, but these tips may be generally useful.

formatting link
Please let me know if you see any errors.

Aaron

Reply to
Aaron Leonard
Loading thread data ...

Technically, isn't a packet sniffer strictly passive? If so, then the comment about the sniffer using a transmitter doesn't make sense.

No mention of wireshark. Is netmon better?

Reply to
miso

Yes.

If you're referring to 1) in

formatting link
- then that's not quite what it says there. Maybe we could word it better.

OK, let's break this down ...

  • Wireshark actually works well in Mac OS X 10.7 to do a wireless sniff, and in fact our doc
    formatting link
    gives some examples

  • Wireshark also can be used in Linux to do a wireless sniff ... we decided not to document anything in this area however, because there are so many variants of Linux, not to mention driver issues.

  • With Windows, however, Wireshark normally *can't* do a wireless sniff. The exception is with the AirPcap adapters from Riverbed (nee CACE). (It would be ideal if Wireshark could be enhanced to hook into the Windows 7 driver API for promiscuous wireless ... but on the other hand, as Riverbed is a sponsor of Wireshark's ...)

Thus, when it comes to "free" wireless sniffing in Windows 7, Netmon is the only game in town. I'm not too thrilled about the user interface, but it does usually work pretty well (modulo whatever the capabilities of the underlying adapter may provide.)

Thanks for the feedback.

Aaron

Reply to
Aaron Leonard

formatting link
"Note that, even though Netmon 3.4 is supported with XP SP3 and Vista, it supports wireless sniffing only if running Windows 7."

Netmon (3.4) does monitor mode wireless sniffing fine in (64-bit) Vista on my Macbook early 2009 with the Apple driver from Boot Camp. Wirelss card is Broadcom BCM43xx 1.0 (5.10.91.22) - as seen in System Profiler in OS X 10.5.8.

Reply to
Axel Hammerschmidt

Thanks Axel; I've updated the article accordingly.

Btw, Netmon 3.4 also captures some interesting wireless packets when used in non-promiscuous mode, on an adapter in production use. At least on my Intel 6300, I get to see some beacons and probe/authentication/association responses from the AP (although not the probe/authentication/association requests that I'm sending out.)

(Writing that up is on the to-do list.)

Cheers,

Aaron

Reply to
Aaron Leonard

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.