Use Wireshark to snif other computers on the same wifi network

[Aaron Schneider]

I'm connected to a network with WPA-CCMP-PSK, and running Kali on a computer with Intel Centrino Advanced-N 6200 AGN wifi card. I open Wireshark in promiscuous mode, however I can only view the packages received or sent from me. For the other computers, I can only see few packets, like NBNS, MDNS, WOL, but can't see any TCP, HTTP or any other. I think the issue is with the network card, that doesn't support promiscuous mode, but I don't know if there is a command or something to know that for sure, without having to buy a different card.

Can somebody help me on this?
___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Enno Rey]

Hi,

it might also be the network (more precisely: the APs) implement PSPF / wireless client isolation.
in that case you won't be able to see other stations' traffic anyway. you might use wifitap (iirc part of Kali, too) to communicate, but sniffing won't work.

best

Enno


On Tue, Aug 12, 2014 at 09:12:13PM +0000, Aaron Schneider wrote:
> I'm connected to a network with WPA-CCMP-PSK, and running Kali on a computer with?Intel Centrino Advanced-N 6200 AGN wifi card. I open Wireshark in promiscuous mode, however I can only view the packages received or sent from me. For the other computers, I can only see few packets, like NBNS, MDNS, WOL, but can't see any TCP, HTTP or any other. I think the issue is with the network card, that doesn't support promiscuous mode, but I don't know if there is a command or something to know that for sure, without having to buy a different card.
>
> Can somebody help me on this?
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

--
Enno Rey

ERNW GmbH - Carl-Bosch-Str. 4 - 69115 Heidelberg - www.ernw.de
Tel. [phone] - Fax [phone] - Cell [phone]

Handelsregister Mannheim: HRB 337135
Geschaeftsfuehrer: Enno Rey

=======================================================
Blog: www.insinuator.net || Conference: www.troopers.de
Twitter: @Enno_Insinuator
=======================================================
___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Aaron Schneider]

I don't think it's the network, because with dSploit and zANTI for android I can see all traffic, http requests and everything, being in any case a network client.

> Hi,
>
> it might also be the network (more precisely: the APs) implement PSPF / wireless client isolation.
> in that case you won't be able to see other stations' traffic anyway. you might use wifitap (iirc part of Kali, too) to communicate, but sniffing won't work.
>
> best
>
> Enno


___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Patrick Meissner]

Hi;

To verify if your network card can support monitor mode, you can do the
following in KALI;

#airmon-ng start wlan0 (or what ever you adapter is wlan1 etc)

This should put your card in monitor mode if it supports it. Then do;

#airmon-ng

you should see wlan0 and mon0 as a listing of adapters.

If you see mon0 then you know that the card is capable of monitor modem
and use the mon0 adapter in Wireshark.

Hope that helps.

P


> Hi,
>
> it might also be the network (more precisely: the APs) implement PSPF /
> wireless client isolation.
> in that case you won't be able to see other stations' traffic anyway. you
> might use wifitap (iirc part of Kali, too) to communicate, but sniffing
> won't work.
>
> best
>
> Enno
>
>
> On Tue, Aug 12, 2014 at 09:12:13PM +0000, Aaron Schneider wrote:
>> I'm connected to a network with WPA-CCMP-PSK, and running Kali on a
>> computer with?Intel Centrino Advanced-N 6200 AGN wifi card. I open
>> Wireshark in promiscuous mode, however I can only view the packages
>> received or sent from me. For the other computers, I can only see few
>> packets, like NBNS, MDNS, WOL, but can't see any TCP, HTTP or any other.
>> I think the issue is with the network card, that doesn't support
>> promiscuous mode, but I don't know if there is a command or something to
>> know that for sure, without having to buy a different card.
>>
>> Can somebody help me on this?
>> ___________________________________________________________________________
>> Sent via: Wireshark-users mailing list
>> <wireshark-users-IZ8446WsY0/***@public.gmane.org>
>> Archives: http://www.wireshark.org/lists/wireshark-users
>> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
>
> --
> Enno Rey
>
> ERNW GmbH - Carl-Bosch-Str. 4 - 69115 Heidelberg - www.ernw.de
> Tel. [phone] - Fax [phone] - Cell [phone]
>
> Handelsregister Mannheim: HRB 337135
> Geschaeftsfuehrer: Enno Rey
>
> =======================================================
> Blog: www.insinuator.net || Conference: www.troopers.de
> Twitter: @Enno_Insinuator
> =======================================================
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
>


___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Aaron Schneider]

Hi:

Indeed I'm able to get monitor mode on the interface mon0, but now the protocol for all packets is 802.11. What's next?

> Hi;
>
> To verify if your network card can support monitor mode, you can do the
> following in KALI;
>
> #airmon-ng start wlan0 (or what ever you adapter is wlan1 etc)
>
> This should put your card in monitor mode if it supports it. Then do;
>
> #airmon-ng
>
> you should see wlan0 and mon0 as a listing of adapters.
>
> If you see mon0 then you know that the card is capable of monitor modem
> and use the mon0 adapter in Wireshark.
>
> Hope that helps.
>
> P


___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[pmeissner-NR7/]

Now you will need to filter out the wifi management protocols in Wireshark, or you could do a filter on just TCP or UDP etc in Wire shark

P
Sent wirelessly from my BlackBerry device on the Bell network.
Envoyé sans fil par mon terminal mobile BlackBerry sur le réseau de Bell.

-----Original Message-----
From: Aaron Schneider <notstop-***@public.gmane.org>
Sender: wireshark-users-bounces-IZ8446WsY0/***@public.gmane.org
Date: Tue, 12 Aug 2014 22:47:22
To: Community support list for Wireshark<wireshark-users-IZ8446WsY0/***@public.gmane.org>
Reply-To: Community support list for Wireshark <wireshark-***@wireshark.org>
Subject: Re: [Wireshark-users] Use Wireshark to snif other computers on the
same wifi network

Hi:

Indeed I'm able to get monitor mode on the interface mon0, but now the protocol for all packets is 802.11. What's next?

> Hi;
>
> To verify if your network card can support monitor mode, you can do the
> following in KALI;
>
> #airmon-ng start wlan0 (or what ever you adapter is wlan1 etc)
>
> This should put your card in monitor mode if it supports it. Then do;
>
> #airmon-ng
>
> you should see wlan0 and mon0 as a listing of adapters.
>
> If you see mon0 then you know that the card is capable of monitor modem
> and use the mon0 adapter in Wireshark.
>
> Hope that helps.
>
> P


___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe
___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Aaron Schneider]

There is *only* the 802.11 protocol for all packets. No http, tcp or anything else.

> Now you will need to filter out the wifi management protocols in Wireshark, or you could do a filter on just TCP or UDP etc in Wire shark
>
> P

___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Aaron Schneider]

I'm authenticated to the wpa network with wlan0, but not with mon0, because you can't be authenticated in monitor mode. I presume the traffic is all encrypted if I'm on wpa and not if it's open.

----------------------------------------
> From: Patrick
> To: Aaron Schneider
> Subject: RE: [Wireshark-users] Use Wireshark to snif other computers on the same wifi network
> Date: Tue, 12 Aug 2014 20:17:21 -0400
>
> Are you authenticated to the wireless network? If not then you will not see
> any clear packets since they are encrypted. If the network is OPEN with no
> WEP WPA etc then you will see the protocols such as TCP and UDP etc. I know
> I have done it myself.
>
> Patrick

___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users-IZ8446WsY0/***@public.gmane.org>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[TimO]

Aaron... for an easy WiFi monitor go to whoisonmywifi.com....they have a free WiFi monitor...if you need any help google lovemytool john Kerber for an overview from the founder...Tim.the oldcommguy

Sent from my Verizon Wireless - ***@Oldcommguy.com

Aaron Schneider <***@live.com> wrote:

>Hi:
>
>Indeed I'm able to get monitor mode on the interface mon0, but now the protocol for all packets is 802.11. What's next?
>
>> Hi;
>>
>> To verify if your network card can support monitor mode, you can do the
>> following in KALI;
>>
>> #airmon-ng start wlan0 (or what ever you adapter is wlan1 etc)
>>
>> This should put your card in monitor mode if it supports it. Then do;
>>
>> #airmon-ng
>>
>> you should see wlan0 and mon0 as a listing of adapters.
>>
>> If you see mon0 then you know that the card is capable of monitor modem
>> and use the mon0 adapter in Wireshark.
>>
>> Hope that helps.
>>
>> P
>
>
>___________________________________________________________________________
>Sent via: Wireshark-users mailing list <wireshark-***@wireshark.org>
>Archives: http://www.wireshark.org/lists/wireshark-users
>Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-***@wireshark.org?subject=unsubscribe