1

I am trying to capture packets from other devices that are connected to the same network as I am. I know the difference between monitor mode and promiscuous mode (explained in this question), but for my purposes I feel that promiscuous mode is more useful.

My problem is, how can I configure a wireless interface to capture the traffic in promiscuous mode?

(FYI: I have already captured traffic in monitor mode, but it's useless as the traffic is encrypted. Also, I am trying this on a Raspberry Pi 3B+ with Kali linux with Nexmon installed, if that's any help. However, I can use Raspbian as well, if necessary)

Nht_e0
  • 15
  • 3

2 Answers2

2

I am trying to capture packets from other devices that are connected to the same network as I am.
... I feel that promiscuous mode is more useful.
... the traffic is encrypted.

Promiscuous mode is likely not what you want.

To cite from the WireShark Wiki: "However, on a "protected" network, packets from or to other hosts will not be able to be decrypted by the adapter, and will not be captured, so that promiscuous mode works the same as non-promiscuous mode."

Note that this is not a restriction of WireShark but a restriction due to the design of protected WLAN. Thus it will not help to just change the capture tool.

See also Wireshark - I can't see traffic of other computer on the same network in promiscuous mode.

Steffen Ullrich
  • 184,332
  • 29
  • 363
  • 424
  • What if I am connected to the network? (as another device) – Nht_e0 Jul 07 '19 at 21:28
  • 1
    @Nht_e0: it does not help. The encryption keys in WPA2 are pairwise between the devices. Since the local network card does not know the encryption keys of the other devices it cannot decrypt the traffic. For more see https://security.stackexchange.com/a/89083/37315 – Steffen Ullrich Jul 07 '19 at 21:39
0

You go to the interfaces window *

Note: "Even in promiscuous mode you still won’t necessarily see all packets on your LAN segment. See the Wireshark FAQ for more information."

*(capture>opt>enable promiscuous mode)

schroeder
  • 123,438
  • 55
  • 284
  • 319