Penetration Testing mailing list archives
Re: WiFi sniffing need to be connected?
From: "5.K1dd" <5.k1dd () austinhackers org>
Date: Tue, 13 Jul 2010 14:51:19 -0500
Last time I used wireshark to sniff wireless it was converting wireless traffic into "pseudo-ethernet", dropping control frames and translating data frames. There is a way to disable that, but point is the translation is the new default.
Enis, If your wireless adapter is in monitor mode, you can not use it simultaneously for a normal connection (you need e.g. managed mode for that). Since you don't have traffic (try it, you can not browse the web when your wireless card is in monitor mode), you can only "listen" to other traffic than your own if your wireless adapter is in monitor mode. If you do want to listen to your own packets, try two wireless cards. Or two PC's. One in monitor mode for sniffing, the other one in managed mode for communicating. If you use wireshark for sniffing, in the Info columns you will see a lot of "beacon frames", "probe responses", "acknowledgements", but also "Data". Easiest manner to filter out overhead, is to use a display filter. Just type "data" (without the quotes) in the display filter field. All that is intercepted traffic. Now if the wireless connection is established using WEP or WPA, it uses encryption and you can not see if there is TCP, UDP, ICMP or other data inside the packet. If wireless connection is unencrypted, you can see all network layers and wireshark will properly dissect them for you. Good luck. Cor
------------------------------------------------------------------------ This list is sponsored by: Information Assurance Certification Review Board Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified. http://www.iacertification.org ------------------------------------------------------------------------
Current thread:
- RE: Should nmap cause a DoS on cisco routers? Dario Ciccarone (dciccaro) (Jul 01)
- WiFi sniffing need to be connected? Vinicius Menezes (Jul 03)
- Re: WiFi sniffing need to be connected? Nikhil Wagholikar (Jul 04)
- Message not available
- Re: WiFi sniffing need to be connected? Nikhil Wagholikar (Jul 07)
- Re: WiFi sniffing need to be connected? kalgecin () gmail com (Jul 07)
- RE: WiFi sniffing need to be connected? Cor Rosielle (Jul 07)
- Message not available
- Re: WiFi sniffing need to be connected? Nikhil Wagholikar (Jul 07)
- Re: WiFi sniffing need to be connected? Enis Sahin (Jul 08)
- Re: WiFi sniffing need to be connected? kalgecin () gmail com (Jul 12)
- RE: WiFi sniffing need to be connected? Cor Rosielle (Jul 13)
- Re: WiFi sniffing need to be connected? 5.K1dd (Jul 15)
- Re: WiFi sniffing need to be connected? Nikhil Wagholikar (Jul 04)
- Re: WiFi sniffing need to be connected? Edwin Rene (Jul 13)
- WiFi sniffing need to be connected? Vinicius Menezes (Jul 03)
- <Possible follow-ups>
- Re: Should nmap cause a DoS on cisco routers? Dobbins, Roland (Jul 01)
- RE: Should nmap cause a DoS on cisco routers? Dario Ciccarone (dciccaro) (Jul 13)
- Re: [Full-disclosure] Should nmap cause a DoS on cisco routers? Dobbins, Roland (Jul 13)