No packets captured on Macbook main wifi interface en0 while Monitor mode is On
Hi everyone,
I have a very strange problem with my Macbook running macOS High Sierra (10.13.6). I was always able to get wifi capture with it using wifi main interface en0. I was simply connecting to different SSIDs and was able to start capture with Monitor Mode On in Wireshark (2.6.6)
Since a week, I'm unable to see over the air packets even if en0 interface is detected and still can see traffic. I haven't done any update of MacOS nor Wireshark.
However, I verified if packets capture was still available on en0 interface using ''Airtool'' application and it is in fact capturing packets. It creates a file that is opened by Wireshark. As most of you might know, Airtool works by specifying channel and channel width. In Wireshark I was simply connecting to SSID to capture packets and was able to see the live capture.
So I know Packet capture works on my Macbook main wifi interface en0. But unfortunately, Wireshark doesn't let me see packets for some reason.
Any help would be very appreciated. Thanks in advance!
What happens if you use tcpdump to capture traffic, e.g.
tcpdump -i en0 -I -w /tmp/capture.pcap. and then try to read the capture file?Hi Guy, thanks for your quick reply.
After running the tcpdump for more than a minute, I have: 0 packets captured 0 packets received by filter 0 packets dropped by kernel = Capture File is empty
So, it looks like my Macbook is able to correctly sniff over the air packets when not connected to any SSID. As soon as I connect it to a SSID (can be Open, WPA2 protected, or else), the Macbook is able to start a trace but unable to see over the air packets.
Has anyone ever encountered this kind of problem?
I have the same exact problem. Running on Mojave 10.14.6.
i have two macbook pro,one is macbook pro 2017,another is macbook pro 2020,they are both macos 10.15.6.
when i use macbook pro 2020,i have the same problem. but i have found a way to solve this porblem, before run wireshark ,you must disconnect from all ssid ,then you can capture 802.11 traffic.
but wireshark work well when i use macbook pro 2017 with connect a ssid.