Where are IP headers in Monitor mode capture?

asked 2018-02-12 11:13:00 +0000

Vindra
13 ●2 ●8 ●11

updated 2018-10-26 17:42:52 +0000

11115 ●11 ●317 ●165 https://www.igt.com/

Hi, I set my lone network interface of Mac_air to Promiscous and Monitor mode at the same time. I could surf Internet while network being in the above mode. But the traffic captures show most packets had the following header hierarchy: Data -> IEEE 802.11 -> 802.11 radio info -> Radiotap header -> Frame.

Where are IP and TCP headers gone?

Regards

edit retag flag offensive close merge delete

add a comment

1 Answer

Sort by » oldest newest most voted

answered 2018-02-12 13:27:59 +0000

sindy
6209 ●5 ●66 ●55

They are all there but encrypted. For each client-AP "session" you want to decrypt, you need to know the passphrase and capture the four EAPOL packets. When you give this information to Wireshark in the right way, it will automatically decrypt those radio frames for which it has the necessary information and show you the IP and above layers dissected.

edit flag offensive delete link

Comments

And see the "How to decrypt 802.11" page on the Wireshark Wiki.

Guy Harris ( 2018-02-12 18:00:43 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2018-02-12 11:13:00 +0000

Seen: 1,274 times

Last updated: Feb 12 '18

Where are IP headers in Monitor mode capture? edit