Cannot capture packets in monitor on Mac Mojave

asked 2018-10-05 17:19:33 +0000

ohy1994
1 ●1 ●1 ●1

I can capture the non monitor mode packets but can't capture in monitor mode. Could it be a bug around Mojave? Used my friend's older macbook and could do it

edit retag flag offensive close merge delete

Comments

Mojave 10.14.1, no packets with en0 in monitor mode.

TnIan ( 2019-02-22 21:16:43 +0000 )edit

add a comment

2 Answers

Sort by » oldest newest most voted

answered 2019-02-22 21:28:05 +0000

Guy Harris
19890 ●3 ●660 ●207

Try doing

tcpdump -i en0 -I

and see if you get any traffic.

If not, this is an issue with macOS, not with Wireshark, so go to the Apple bug reporter. If you don't have an account, create one. Then file a bug on this; include the full result of "System Report" from "About This Mac" (you can save from there).

edit flag offensive delete link

add a comment

answered 2018-10-06 14:47:15 +0000

Bob Jones
1496 ●2 ●179 ●22 Boston, MA

Just upgraded without issue. Monitor mode produced expected traffic flows on my WiFi networks.

edit flag offensive delete link

Comments

Did you have to enable certain security settings? Wireless diagnostic is working correctly to capture packets but not wireshark.

ohy1994 ( 2018-10-07 03:03:05 +0000 )edit

No, wireshark worked fine, but it was previously installed prior to upgrade.

Bob Jones ( 2018-10-07 07:59:01 +0000 )edit

Ah that's odd, let me try asking around my friends who have Mojave to test. Thanks a lot!

ohy1994 ( 2018-10-07 10:49:43 +0000 )edit

Apple may have "improved" some of their AirPort drivers; see bug 15268, which has a Mojave capture with a bad Radiotap header. Perhaps Apple "improved" the Mojave driver for your machine's Wi-Fi adapter so that it doesn't support monitor mode.

Guy Harris ( 2018-11-09 03:19:21 +0000 )edit

I am seeing the same issue, if enable the monitor mode in en0 which is the wireless interface. The wireshark cannot capture any packets but seems like the Wireless Diagnostics is able to capture frames.

weisheng ( 2019-01-13 09:57:41 +0000 )edit

add a comment