Capturing options

If you are trying to capture traffic between a wireless station running Wireshark and other wired/wireless machines in the network, and interested only in regular network data, not in 802.11 control packets or radio/link-layer information, then you don't have to do anything special. Just open Wireshark, choose the specific wireless interface you are interested in, apply the necessary filters and run it in promiscuous mode.

Using Wireshark, if you want to capture traffic between different processes running within the wireless station, then the capture should be done on a loopback interface.

If you are trying to capture traffic that is not only sent to or from the wireless station running Wireshark but also between different wireless devices in the network—and if you are interested in 802.11 control packets or radio/link-layer informationthen you have to do it by enabling monitor mode, highlighted as follows (Wireshark version 10.6, running on Apple macOS Sierra 10.12.6). This type of capture is often referred to as Over-the-Air (OTA) packet capture.

Figure 9.12: Wireshark interface capture options

Please be aware that Wireshark provides limited capabilities to perform OTA packet captures; several commercial tools and applications are available to provide more comprehensive monitoring and troubleshooting capabilities and features.

In Unix-based operating systems and Apple macOS (10.6 or above), there are a few built-in tools such as airportd, airport utility, Wireless Diagnostics, and tcpdump that can be leveraged for capturing and analyzing wireless packets.
..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.22.74.66