Ask Your Question
0

How to get monitor mode working in Mac OS Catalina

asked 2020-01-26 01:49:40 +0000

jchiar gravatar image

Hi am unable to get monitor mode working in Catalina. Its a new install.

I have 2019 Mac book pro i9 8 core. I am trying to capture in monitor mode. I see monitor mode selected. I see 802.11 plus headers.

I ran the setup and the scripts in the dmg. When I capture it says no packets.

Running as an administrator account.

Help!

edit retag flag offensive close merge delete

Comments

Exactly same issue for me. Spent hours to try to fix it with no luck. tcpdump -i en0 -I doesn't work either (no packet captured). However, build-in app Wireless Diagnostics works and does capture in monitor mode. Multiple feedbacks seem to suggest that monitor mode doesn't work with newer Mac with Mojave or Catalina. Seems that Apple has decided in its great wisdom to disable monitor mode for newer Mac (or it is a bug they don't bother to fix...). Not much to do short term other than begging Apple to do something and to complain about their lack of reliability... or go to Linux....

frob gravatar imagefrob ( 2020-05-15 14:59:26 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted
0

answered 2020-05-15 21:22:18 +0000

Guy Harris gravatar image

Yes, Apple broke monitor mode on at least some machines; I don't know how much of the issue is Mojave (where the breakage appears to have started) and how much of it is new hardware/software - Mojave worked on my old machine, but my new 16" MacBook Pro doesn't handle monitor mode...

...except when you open Wireless Diagnostics (Option+click on the Wi-Fi item in the menu bar, select "Open Wireless Diagnostics...", don't click the "Continue" button, select "Sniffer" from the "Window" menu, select a channel and channel width, and click "Start".

That runs an obscure program called "tcpdump" (as revealed by running "ps -ef" while the sniffing is in progress) from some special daemon that somehow manages to sprinkle pixie dust on tcpdump to allow it to capture in monitor mode. I have not managed to determine what sort of pixie dust that is, so I have no changes to make to libpcap to make it work better.

Note, however, that 1) this appears to dissociate my machine from the network (unlike older machines, where I was able to run in monitor mode and remain associated with the network and able to access other machines on the network - including our Internet gateway) and 2) doesn't always seem to reassociate when you stop capturing.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2020-01-26 01:49:40 +0000

Seen: 1,211 times

Last updated: May 15