Problem capturing packets between smartphone (Android 11) and printer
So I figured out my problem capturing packets between my smartphone and the printer and seeing the IPP traffic on top of the 802.11 packets. My newer macbook had this issue with the networking card and monitoring mode, so i had to use an older macbook in order to be able to capture the packets in the wifi network including the IPP ones from the phone to the printer. However, while i am capturing this fine for smartphones that are running android 10, once i upgraded some other smartphones to android 11, i don't see the IPP traffic any more between the phone and the printer on the network. It works smoothly for all my android 10 phones, but for none of my android 11 phones. I am using the android default printing service for each case, the printer on the network is installed through the android default print service, no extra drivers or anything downloaded. The printer is seen by the smartphone fine, the files print fine, but the IPP packets are't captured for the android 11 devices. suggestions? solutions? thanks much in advance.
Could the Android 11 devices be using a more advanced modulation as compared to the other devices? If so, you will struggle with capturing until you upgrade the capture setup, too.
how would i go about upgrading the capture setup for that?
Do you use an adhoc network between the phone and the printer, or are both connected to an access point? Do you see no packets during the capture, or are they all just encrypted? Are you capturing with your MacBook in the same band and channel as the phone and/or printer is using? Not sure if something for wifi has changed between Android 10 and 11. The first thing I thought about was WPA3. Have you checked if the mobile phones wifi connection uses WPA3 now?
Another way to capture traffic between your phone and printer is to use PcapRemote (see store) on your phone.
both phone and printer are on same wifi (different channels) and connected to access point. I see packets in the wifi but not between the phone and the printer. I have decrypted traffic, i am using monitoring mode on an old machine in order for it to work as the new macbooks have an issue with the card and can monitor a specific channel, but my printer is wired to the network and the phone is wifi-connected to the wifi that sees the wired network and the printer. anyway, i don't see the phone at all. and i am suspecting that it has to do with the encryption certificates for connecting to the wifi. i found this https://www.xda-developers.com/androi... So apparently there is wpa3 enterprise and not personal now and that might explain why i don't see what expected.
These should be mutually exclusive. Some printers can do both wired and wireless, but not a good practice to have both interfaces connected to the same vlan/subnet.
How are you determining this? Are there no 802.11 frames from the phone's MAC address, or are you doing some type of layer3 or higher filter such that you put yourself in a position that to see the traffic, you first have to get it and then decrypt it?
Even if you can't decrypt or pick up the latest-greatest modulations, you would still see some amount of control and management traffic from the wireless devices if you are on the right channel and close enough.