Then I read: Note that Monitor mode is not supported by WinPcap, and thus not by Wireshark or TShark, on Windows. It is supported, for at least some interfaces, on some versions of Linux, FreeBSD, NetBSD, OpenBSD, DragonFly BSD, and Mac OS X. Bummer!! Coffee Break. We need to disable the translation/filtering and see what’s “really” going on inside your WLAN. To capture the real 802.11 packets and radio layer information, then we have to capture in “monitor mode”. We do not see 802.11-specific management and control frames as they are discarded because there’s no equivalent to them in Ethernet We see user data packets with fake Ethernet headers.

“fake” Ethernet: the hardware/driver translates the 802.11 headers into Ethernet headers so that the whole packet looks like a normal Ethernet packet.

“real” 802.11: the hardware/driver provides the actual protocol data that travels over the air, complete with 802.11 headers.

Where are the 802.11 Auth frames? Well, when capturing with Wireshark (or other tools using libpcap/WinPcap) there are two ways in which 802.11 can be supplied by the system and stored in a capture file: Select your WiFi interface that we will use to capture traffic.Īs you can see, the Capture starts from DHCP request process. So far, I have just installed and opened Wireshark.

This blog will explain how to set up Wireshark for WLAN Capturing so that you do not miss the vital packet exchanges. I noticed that my Wireshark output lacked the 802.11 management or control packets while trying to capture Open System Authentication process. If you are studying for CCNP Wireless or CWNP Certification, an essential part of the study process is actually getting to lab it all out so as to understand the concepts.

Wireshark wireless packet capture