 | 1 | initial version |
Promiscuous mode on wireless interfaces is a little different than on wired interfaces. For wireless interfaces you need monitor mode as well to pick up unicast traffic from other devices then promiscuous mode to send it up the stack to be collected. There are drivers out there on Linux that have in the past, or currently, only support monitor mode (and not promiscuous mode) so only group traffic is sent up for collection.
You already described your solution - get another adapter for traffic collection. I would be interested in what you read that indicates that your setup would be successful; it is known not to be effective. When not in monitor mode, unicast traffic for other hosts is dropped. I don't know if it is in hardware or the driver or it might vary by specific device, but it is not available for collection in any event.
Also capturing in monitoring mode and using an interface is sometimes possible, but the results are usually weird and can vary wildly. Sometimes only certain traffic is picked up, as in maybe one direction, or no control frames, or the frames have no radiotap header, etc. All sorts of unusual behavior so it is best to have a separate capture system.
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
