Wireshark – Capturing Wireless Traffic

Since traffic bound for the internet will need to go through a router of some sort to get there, the IP packets will be given the MAC address of the router as the destination. You can filter for all packets with the router's MAC address (e.g. eth.dst == 00:0f:66:03:50:a7) as the destination.

Here are a few possible reasons, in rough order of likelihood:

• A common reason for not seeing other devices' unicast traffic in a monitor-mode packet trace is that you forgot to also set promiscuous mode.

• Another common reason is that the traffic you were looking for wasn't on the channel you were sniffing on. This can happen if you have a dual-band concurrent AP and you were sniffing on its 2.4GHz channel but not its 5GHz channel. Or if your network is made up of more than one AP, and you were sniffing on the channel of one AP, while your target client was joining a different AP on a different channel.

• Another reason could be that those other devices are communicating using a different flavor of 802.11 than what your sniffer card supports. For example, if your sniffer card is only 2x2:2 (2 spatial streams), it won't be able to capture packets sent using 3 spatial streams. Or if it's only capable of 20MHz-wide channels, it won't be able to capture packets that were sent using 40- or 80MHz-wide channels. If your card is only 802.11n, it won't be able to capture 802.11ac.

• Another reason would be if your sniffer machine is not in range of the other devices whose traffic you were hoping to capture. "In range" is tricky because modern technologies like beamforming optimize the signal for the position where the intended recipient is; there's no guarantee that an unintended recipient nearby will receive enough signal strength to demodulate (that is, successfully receive, much less decrypt) the signals.