I'm on Arch Linux installed on a Macbook Air. WiFi runs just fine. But whenever I start to capture network on the WiFi Card on Wireshark, it just suddenly stops working. Pinging google replies "Name or service not known", and even when I reconnect to the WiFi using Network Manager, it just doesn't work. It'll only work when I stopped Wireshark and reconnect to WiFi. Is this normal or is something wrong?
2
-
does wireshark use promiscuous mode?jsotola– jsotola2022-04-14 06:50:41 +00:00Commented Apr 14, 2022 at 6:50
-
yes, it does, but the wireshark running on my windows desktop pc does too, but everything is working fine there igKyi Zet– Kyi Zet2022-04-14 07:16:35 +00:00Commented Apr 14, 2022 at 7:16
Add a comment
|
1 Answer
The most comprehensive way to capture traffic on a WiFi interface is usually the monitor mode. The classic promiscuous mode is also available with WiFi, but less useful on WiFi interfaces, as any WiFi traffic is normally filtered by SSID at the hardware level. The Wireshark documentation says:
Even in promiscuous mode, an 802.11 adapter will only supply to the host packets of the SSID the adapter has joined, assuming promiscuous mode works at all; even if it "works", it might only supply to the host the same packets that would be seen in non-promiscuous mode. Although it can receive, at the radio level, packets on other SSID's, it will not forward them to the host.
In monitor mode, absolutely all packets received from the radio layer are allowed to pass to the host OS and eventually to the application. The monitor mode can also provide access to low-level radio interface management traffic and information that may not be available otherwise.
Unfortunately, the capabilities of different WiFi chips vary in this regard: some chips can be used to monitor while maintaining a WiFi connection, but many are strictly receive-only when in monitor mode, which obviously makes maintaining a WiFi association impossible.
In Wireshark 1.4 or newer, the use of WiFi monitor mode is optional. The "Capture Options" dialog should include a checkbox for it.
