Ask Your Question

How do I turn on monitor mode in wireshark on windows in the capture options?

asked 2023-09-28 01:05:08 +0000

KDAM71 gravatar image

My modem log says "A device failed to connect to SSID (40:5E:F6:4C:64:BE) because it provided incorrect login information" lots of times. The SSID is my phones. I want to look in to it but I can't figure out how to turn on monitor mode in the capture options in wireshark on windows. What do I put in the field under monitor mode?

Sorry for asking a question like this. Any help would be appreciated.

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2023-09-28 07:53:30 +0000

grahamb gravatar image

See the Wiki page on WLAN capture and in particular the note:

Unfortunately, changing the 802.11 capture modes is very platform/network adapter/driver/libpcap dependent, and might not be possible at all (Windows is very limited here).

I think you're running into the latter problem, your hardware\firmware\driver doesn't support monitor mode.

edit flag offensive delete link more


Thank you for your reply . I had read that. Is there a way I can verify this is the case? Is there a workaround?

I'm on windows 11 home 22H2 Wifi hardware: Intel Wi-Fi 6 AX201 160MHz

KDAM71 gravatar imageKDAM71 ( 2023-09-28 11:17:44 +0000 )edit

A workaround is to NOT use Windows and instead use another OS with hardware that is known to be supported. That may or may not help.

grahamb gravatar imagegrahamb ( 2023-09-28 11:40:35 +0000 )edit

I understand all the parts in the "chain" have to support the function in order for it to work. Is there a way to check which part(s) is/are not?.

KDAM71 gravatar imageKDAM71 ( 2023-09-28 13:24:09 +0000 )edit

I found out it's the wifi hardware that doesn't support it. On the windows command line you can use the command "netsh wlan show wirelesscapabilities" to check.

Thanks for the help.

KDAM71 gravatar imageKDAM71 ( 2023-09-28 15:41:59 +0000 )edit

That's useful, I'll add that to the wiki page.

Normally we don't close questions, instead the best answer is accepted (to inform others) by clicking the checkmark icon next to the answer.

grahamb gravatar imagegrahamb ( 2023-09-28 15:52:20 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2023-09-28 01:05:08 +0000

Seen: 3,831 times

Last updated: Sep 28 '23