Ask Your Question

Get 802.11 frames while associated with network

asked 2021-01-29 09:55:24 +0000

AlahambraOligododo gravatar image

updated 2021-01-29 15:37:54 +0000

I want to record the 802.11 management frames, and in particular association requests, of my MacBook Air (M1) with my MacBook Air. So far, I'm able to detect the management frames of "other" devices, when I use the monitor mode.

However, tells me: "It's possible to capture in monitor mode on an AirPort Extreme while it's associated, but this necessarily limits the captures to the channel in use." Hence, I think that a caputure of the wifi traffic in monitor mode while associated is what I'm looking for. As the new MacBook still uses the AirPort Extreme there should be a solution?

However, - when I'm associated with a network and enable the monitor mode, I do not record any packages - when I'm not associated with a network and the monitor mode is enabled, I cannot associate with a network - when I use promiscuous mode instead, I can associate and disassociate but I do not get any management frames.

edit retag flag offensive close merge delete

2 Answers

Sort by ยป oldest newest most voted

answered 2021-01-29 20:05:00 +0000

Guy Harris gravatar image

As the new MacBook still uses the AirPort Extreme there should be a solution?

Perhaps you want there to be a solution, but that doesn't mean that there is a solution.

"AirPort Extreme" isn't a particular device; it's a name that I think was, at one point, used for some 802.11 adapters in Mac notebooks, as well as for later Apple base stations. Apple no longer use that name.

I will update the Wiki to indicate that newer AirPort adapters do not appear to be capable of capturing traffic while associated to a network.

Note, by the way, that the Wireshark Wiki has moved; it's no longer at, it's now on Wireshark's GitLab site. The page section Amato_C referred to is now at

edit flag offensive delete link more

answered 2021-01-29 15:00:30 +0000

Amato_C gravatar image

Usually the wireless adapter is unable to transmit in monitor mode and is restricted to a single wireless channel, though this is dependent on the wireless adapter's driver, its firmware, and features of its chipset.

When you associate to the network, you are in promiscuous mode. Also see the Wireshark Wiki:

edit flag offensive delete link more


Sorry, I think my question was misleading. I edited my original question.

AlahambraOligododo gravatar imageAlahambraOligododo ( 2021-01-29 15:39:09 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2021-01-29 09:55:24 +0000

Seen: 660 times

Last updated: Jan 29 '21