Ask Your Question

Revision history [back]

Monitor Mode checkbox on Wireshark is "--" despite having capability

Good MorningNoonNight,

The Neat: Intel 7265 and Intel 8265 NIC

Kali Linux 2021.3 Live USB

WireShark 3.4.7

The Gritty: I am trying to capture packets in a room we are troubleshooting for interference issues and the vendor has asked me to use a third device (either Mac or Linux -- we are a Microsoft shop) to capture the packets with WireShark in Monitor Mode.

I have tried on two of our devices that have the Intel 7265 and Intel 8265 NIC's. Both are supposed to support Monitor Mode according to online research and using IW list.

Steps:

(1) I kill all processes that would disrupt Monitor mode

(2) I set the interface to monitor mode

(3) I set the channel to monitor

(4) I load wireshark

(5) I select promiscuous mode

(6) I select my wireless monitor mode interface (wlan0mon)

(7) There is a -- by monitor mode where there should be a check box.

I have tried capturing packets anyway, and admittedly I don't 100% know what I should be seeing, but I typically only see probe requests with destination of broadcast and I thought it would be more specific than that. And also not just probe requests.

Anything I could be doing wrong / not understanding about this?

Monitor Mode checkbox on Wireshark is "--" despite having capability

Good MorningNoonNight,

The Neat: Intel 7265 and Intel 8265 NIC

Kali Linux 2021.3 Live USB

WireShark 3.4.7

The Gritty: I am trying to capture packets in a room we are troubleshooting for interference issues and the vendor has asked me to use a third device (either Mac or Linux -- we are a Microsoft shop) to capture the packets with WireShark in Monitor Mode.

I have tried on two of our devices that have the Intel 7265 and Intel 8265 NIC's. Both are supposed to support Monitor Mode according to online research and using IW list.

Steps:

(1) I kill all processes that would disrupt Monitor mode

(2) I set the interface to monitor mode

(3) I set the channel to monitor

(4) I load wireshark

(5) I select promiscuous mode

(6) I select my wireless monitor mode interface (wlan0mon)

(7) There is a -- by monitor mode where there should be a check box.box. I have also tried starting monitor mode using the CLI but get a return of "can't start as monitor mode is not supported."

I have tried capturing packets anyway, and admittedly I don't 100% know what I should be seeing, but I typically only see probe requests with destination of broadcast and I thought it would be more specific than that. And also not just probe requests.

Anything I could be doing wrong / not understanding about this?