 | 1 | initial version |
Some of the reasons monitor mode capture won't show IP address include: capturing on the wrong channel, capture setup cannot pick up the data frames you want, the traffic is encrypted, and others.
You almost certainly have a switched network which filters frames not destined for your host and wireless adapters drop unicast traffic not destined for the interface unless in monitor mode.
The best option to collect traffic if you care about anything above L2 is to collect wired network traffic with a network tap or other technique (mirror port, etc) as it will be much easier to analyze. You can collect this at the wired side of the AP or perhaps in front of the router or other suitable place.
If you have to do wireless capture, then work through all the issues in the wiki to setup your monitor mode capture.
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
