Ask Your Question

Revision history [back]

Can't capture data packets from unencrypted Wifi network in monitor mode

I can't capture data packets from an unencrypted Wifi network while in monitor mode.

I have my phone set up as a unencrypted 2.4GHz hotspot, and my laptop's built-in adapter connected to it. I'm running Fedora 33 kernel 5.8, and iw dev says that it's on channel 11. I have a USB WIFI adapter plugged into my laptop in monitor mode (as confirmed by iw dev) and tuned to channel 11. I can see lots of management packets from both my hotspot and nearby Wifi APs, but I can see very few packets that are anything but Wifi, and most of those are ICMP or ARP. Although, I'm pinging 8.8.8.8 successfully the whole time and don't see that in the trace at all. I can't see any actual data packets like HTTP requests at all.

I've set monitor mode with iw $IFACE set monitor control, and I can't select the monitor mode checkbox in Wireshark on this interface: it unchecks itself immediately if I try. (Also if I try to check the monitor mode checkbox on my built-in adapter Wireshark segfaults and I drop a few packets from my ping.)

I can't find any relevant information about this: searching for these symptoms returns results for either Windows (I'm on Linux) or for encrypted networks, and I'm on an unencrypted network explicitly to rule that out. Any ideas?

Example trace. Note that my laptop's adapter's MAC is b4:ae:2b:d5:86:a2, my USB Wifi card's is fe:70:8e:b4:16:a0, and my phone's is 94:65:2d:2c:aa:79.