Wireshark doesn't capture packets from all devices

asked 2018-05-02 14:11:43 +0000

Lorkes gravatar image

updated 2018-05-08 11:55:40 +0000

My problem is that Wireshark captures packets only from my laptop and another one but not from my phones (I have 3 phones connected to my home Wi-Fi AP). I'm sure that packets are sent. When I'm trying to capture packets from my phone using "host {phone's IP}" capture filter Wireshark captures only ARP packets. A few days ago everything was alright. I don't use any capture/display filters. Wireshark v2.4.5 on Kali Linux kernel 4.15.0 x64

UPD: tried to capture on Windows 8.1 (dual-boot system) and got the same result

UPD2: tried to capture on open network, everything seems working. So I think, problem is not in the Wireshark, but in the network. Thanks for help

edit retag flag offensive close merge delete

Comments

My problem is that Wireshark captures packets only from my laptop and another one but not from my phones (I have 3 phones connected to my home Wi-Fi AP).

Are you capturing in monitor mode on the Wi-Fi adapter on the machine running Wireshark?

Guy Harris gravatar imageGuy Harris ( 2018-05-03 07:26:29 +0000 )edit

no, I'm capturing in station mode. I have tried to capture in monitor mode but it didn't help. Wireshark continues capturing packets only from my laptop but now every protocol is 802.11, not TCP/TLS as when capturing in station mode. But as i wrote above, a few days ago everything was alright and I was able to capture every packet sent in my Wi-Fi without using monitor mode.

Lorkes gravatar imageLorkes ( 2018-05-03 12:54:46 +0000 )edit

Is your network using any form of encryption, i.e. WEP or WPA/WPA2?

Guy Harris gravatar imageGuy Harris ( 2018-05-05 20:49:30 +0000 )edit

Yes, WPA2

Lorkes gravatar imageLorkes ( 2018-05-06 01:31:32 +0000 )edit

So, a few days ago, you were capturing with monitor mode off (and, presumably, promiscuous mode on), and Wireshark was able to see MAC-layer unicast packets (not broadcast and not multicast) not sent to or from the machine running Wireshark? Did those packets have 802.11 or Ethernet headers? If 802.11 headers, had you told Wireshark what the password was for the network?

Guy Harris gravatar imageGuy Harris ( 2018-05-08 18:13:10 +0000 )edit