Hi! I'm using linux mint which is an ubuntu dist., wireshark v1.4.6, installed it just a week ago. I have several computers connected to the same wireless network and I want to be able to see all the traffic. Using wlan0, I can only monitor my own traffic (i.e. of the computer running wireshark). Tried to check the "capture in monitor mode", it blinks and remains blank. Tried to enable the monitor mode via airmon-ng so I get the mon0 interface, I can use it with wireshark but it does not scan http traffic, shows only IEEE 802.11 as protocol during scanning and again the "capture in monitor mode" option does not work. Is there something I can do?
asked 02 Jan '12, 03:09
They are inside your trace - filter for "wlan.fc.type_subtype == 0x20" and there you have your TKIP encrypted data frames containing http and all other packets you are looking for.
So to see the traffic, you have to decode the trace first, which is the difference when capturing on your wlan0 interface, where the traffic has already been decrypted before you see it in wireshark (but of course only your own traffic since it's not mon0)
All you need is in the wiki under http://wiki.wireshark.org/HowToDecrypt802.11
answered 04 Jan '12, 06:54
You may find this question useful. As for sniffing traffic other than yours you may want to try a man in the middle attack through arp spoofing in order to hijack the other machines' packets to your machine (there are many applications which can do it, e.g. ettercap) and then use wireshark to sniff the traffic.
answered 02 Jan '12, 18:56