Hello, I'm using Debian, when I go to "Capture Options" and select the wlan0 interface, if I try to set it to monitor mode clicking on the checkbox "Capture packets in monitor mode", the "Link-layer header type" menu blinks for a second and the checkbox remains blank. The "Link-layer header type" menu shows only two options: "Ethernet" and "DOCSIS", with both options the monitor mode checkbox has the same behaviour. If I do the following:
then the only option in the "Link-layer header type" menu is "802.11 plus radiotap header" but the behaviour of the monitor checkbox remains the same. Does anyone have any idea about what the problem is? Thanks in advance.
OK, this is a combination of several problems:
I've checked into the trunk and 1.6 branches a fix for the third problem; it should now pop up an error message box if you try to check the monitor mode checkbox on platforms with the libpcap problems in question. The error message will refer you to the CaptureSetup/WLAN page in the Wireshark Wiki, but it should really specifically refer you to the Linux section of that page. I'll fix it to do so later. The 1.6 branch changes should also go into 1.4, so they show up in the next 1.4.x release as well as the next 1.6.x release.
I've checked into the libpcap trunk and 1.2 branches a fix for the second problem, so they should show up in any future 1.2.x release (there are enough bug fixes that tcpdump.org should consider doing a 1.2.x release - and announce it so that various OSes pick it up) as well as any 1.3.0 release when it comes out. When that'll happen, I don't know, and I don't know whether any of the Linux distributions with this issue would pick it up as an update to existing releases or whether you'd have to wait for a future release. Given that anything short of Sid appears to have Wireshark 1.2.x as the Wireshark version, people who run into this are probably building Wireshark from source anyway, so they might end up picking up the fix for the third problem - monitor mode won't work well with the checkbox or the
I've sent mail to Romain Francoise, the Debian maintainer for libpcap, about the first problem. Hopefully the fix is as simple as declaring libnl to be one of libpcap's dependencies.
answered 06 Dec '11, 22:42
Guy Harris ♦♦