Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

asked 2023-12-02 20:54:28 +0000

Atef gravatar image

Why Wireshark Doesn't capture any packets in monitor mode?

I know this question is common, but I can't find any solution. I'm trying to use Wireshark to sniff on my WLAN, and what I've done:

  • Check if my wireless interface support monitor mode.

    output from iw list command:

            * Supported interface modes:

 * IBSS
 * managed
 * AP
 * monitor
 * mesh point
 * P2P-client
 * P2P-GO
 * P2P-device

  • Stop network managers then kill interfering processes using airmon-ng check kill

  • Enable monitor mode with airmon-ng start wlan0, output:

    PHY Interface Driver Chipset

    phy0 wlan0 ath10k_pci Qualcomm Atheros QCA6174 802.11ac Wireless Network Adapter (rev 32) (mac80211 monitor mode vif enabled for [phy0]wlan0 on [phy0]wlan0mon) (mac80211 station mode vif disabled for [phy0]wlan0)

  • Show the current status of the wireless interfaces iwconfig:

    lo no wireless extensions.

    wlan0mon IEEE 802.11 Mode:Monitor Frequency:2.457 GHz Tx-Power=-2147483648 dBm
    Retry short limit:7 RTS thr:off Fragment thr:off Power Management:on

  • Then start Wireshark sudo wireshark

The Wireshark doesn't recognize the monitoring mode of the interface and doesn't show the checkbox under monitoring column.

My OS details:

PRETTY_NAME="Debian GNU/Linux 12 (bookworm)" NAME="Debian GNU/Linux" VERSION_ID="12" VERSION="12 (bookworm)" VERSION_CODENAME=bookworm

Wireshark Version:

Wireshark 4.0.11 (Git v4.0.11 packaged as 4.0.11-1~deb12u1). Running on Linux 6.1.0-13-amd64.