Ask Your Question

Capture on WiFi works for all but device I'm interested in

asked 2019-01-07 20:07:03 +0000

noingwhat gravatar image

I'm trying to sniff traffic to / from a Meross smart plug I have on my network. I am using wireshark in Kali on a virtual machine with a USB wifi adapter (RTL8812AU). I was able to successfully put the adapter into monitor mode and decrypt traffic on my WPA2 network, and I'm able to see other traffic such as to and from the Kali VM, traffic on my host computer, and my smartphone.

What I am not able to find is any traffic to the smart plug. According to my router, the plug has the IP of, and if I try to filter by that on wireshark I see nothing. I am able to filter by my host computer's IP, and the IP of my phone and that traffic appears perfectly normal (this is after the WPA2 handshake, decryption works correctly). When I check on the routers "traffic statistics" page it is showing that the number of packets sent / received to the smart plug increases when I turn it on and off, but Wireshark still doesn't show any data for that IP.

All these devices are connected to the same network (Only using the 2.4 for this test, 5Ghz is under a different SSID), I have no capture filters, and no display filters other than for the smart plug's IP. What could I be missing?

edit retag flag offensive close merge delete


Hi, I have the same issue and I can't see any traffic from/to meross device...any idea? Thanks

dvpe gravatar imagedvpe ( 2019-10-15 19:21:29 +0000 )edit

"All these devices are connected to the same network"
Can you ping the Meross from the Kali VM? Is there in entry in the ARP cache for it?
If it responds to the ping then you can set a filter for ICMP to see the traffic to/from the Meross. That would help to verify that you can receive traffic from it.

'routers "traffic statistics" page it is showing ...'
1. Does the router have a ping utility and if so does the Meross respond to a ping?
This will give you a more consistent way to generate packets instead of power cycling.
2. If the router is the DHCP server handing out the address, verify the MAC its assigned to.

Chuckc gravatar imageChuckc ( 2019-10-16 00:25:26 +0000 )edit

1 Answer

Sort by » oldest newest most voted

answered 2019-01-07 23:47:34 +0000

Bob Jones gravatar image

I would suggest searching for the device via its MAC address instead of ip. Ip requires decryption to be successful while the Mac will show in any case. Use something like wlan.addr == <mac>

First see if you can find the device at all, and you need data or qos-data frames to contain the IP address. It could be you are not getting all 4 eapol frames; maybe device is connected on a different channel than you expect. It’s also possible that the modulation is higher than what the monitor supports but doubt that is the case here.

What do you see when you look for that MAC address?

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools



Asked: 2019-01-07 20:07:03 +0000

Seen: 1,387 times

Last updated: Oct 15 '19