Ask Your Question

Sniffing (forwarded) wifi packets using promiscuous mode

asked 2018-05-20 23:50:27 +0000

anonymous user


I have 3 network participants:

  • An open (no WEP, no WPA, no Encryption ) wireless access point (AP) at
  • Client A at, sniffing with promiscuous mode turned on
  • Client B at

All hosts are running Linux.

Suppose A sends an ICMP echo request to B. I would expect to receive 4 packets (ignoring the wireless Dot11 acks, etc...):

  • ICMP echo request from A -> AP
  • ICMP echo request from AP -> B
  • reply from B -> AP
  • reply from AP -> A

But all I get is a request from A -> B and a reply from B -> A. I cannot seem to capture the intermediate (forwarded) packets.

Further testing showed that while in promiscuous mode client A does not seem to capture any unicast packets that do not originate or end at A. Putting A's interface into monitor mode shows all expected packets as well as a lot of unneeded others, at the cost of being able to actually send any data.

While one obvious solution might be to use a second wireless adapter on A dedicated to monitoring, I do not currently have access to one. From everything i have read so far promiscuous mode "should" work, capturing all packets associated with AP's network. Are the Packets somehow pre-filtered by the interface adapter or the kernel? And if yes, can this be circumvented?

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2018-05-21 00:12:19 +0000

Bob Jones gravatar image

Promiscuous mode on wireless interfaces is a little different than on wired interfaces. For wireless interfaces you need monitor mode as well to pick up unicast traffic from other devices then promiscuous mode to send it up the stack to be collected. There are drivers out there on Linux that have in the past, or currently, only support monitor mode (and not promiscuous mode) so only group traffic is sent up for collection.

You already described your solution - get another adapter for traffic collection. I would be interested in what you read that indicates that your setup would be successful; it is known not to be effective. When not in monitor mode, unicast traffic for other hosts is dropped. I don't know if it is in hardware or the driver or it might vary by specific device, but it is not available for collection in any event.

Also capturing in monitoring mode and using an interface is sometimes possible, but the results are usually weird and can vary wildly. Sometimes only certain traffic is picked up, as in maybe one direction, or no control frames, or the frames have no radiotap header, etc. All sorts of unusual behavior so it is best to have a separate capture system.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2018-05-20 23:50:27 +0000

Seen: 1,044 times

Last updated: May 21 '18