I want to monitor the HTTP traffic of all clients connected via wifi to my wireless router. I want to capture the traffic with my Notebook which is also wirelessly connected to the router.
Hardware & Software setup:
Capturing with: Intel 7260 Wireless, Ubuntu 14, Wireshark & Aircrack-ng
Client to monitor: Android Smartphone
Router: Wireless Router 2.4GHz 802.11n, fixed wifi channel
//
What I did til now (without any success):
sudo airmon-ng start wlan0
// mon0 is started successfully
gksu wireshark
// warns me that I should not run it in root, but I want to see that this works first, I'll take care of security later
In Edit-> Preferences -> Protocols -> IEEE802.11:
Reassemble fragmented 802.11 datagrams: true
Ignore vendor-specific HT elements: false
Call subdissector for retransmitted 802.11 frames: true
Assume packets have FCS: false
Ignore the Protection bit: Yes with IV
Enable Decryption: true
Decryption Keys: wpa-pwd, mywlanpassword:myrouterssid
In the capture options:
Capture Interface: mon0
promiscuous mode: true
snaplen: default
buffer: 2mib
monitor mode: disabled
// I also tried with true but it doesn't seem to make a difference as due to usage of airmon-ng I suppose that monitoring is already enabled
Display options: all true
Name resolution: all false
After starting the capture I disable WIFI on my Smartphone and reenable it. I can see that some MDNS packets are captured and a one time IGMPv2. But when I browse on the phone (normal http sites, no network compression activated) or use any apps that would connect with online service, I don't see any HTTP or TCP traffic for the Smartphone. If I start the browser on my notebook I see all browser traffic (HTTP requests, responses, files etc).
Am I missing something?