Why isn't Wireshark showing high layer packets like ICMP/IP/UDP? (Only broadcast packets are shown)

1

I am using Wireshark for 802.11g sniffing. The AP is not using any encryption. These are my observations:

  1. The vast majority packets are beacons and the probe requests.
  2. If I filter out beacons using the filter !(wlan.fc.type_subtype==0x08), I can see some ARP, ICMPv6, IGMPv3 and DHCP packets. These packets mostly came when a fresh connection is made from a station to an AP.
  3. When I do Ping or telnet, I cannot see any Data packets, even when the Ping/telnet operations are clearly going on and successful.
  4. Basically, Only broadcast packets get displayed. (One exception is some packets are shown with Destination Address being Cisco_00:00:00/01:0b:85:00:00:00).

Does anybody know what went wrong?

My Wireshark version is 1.8.2. I am using a Ubuntu 12.10 and a USB wireless adaptor Belkin F5D7050. I have put the WLAN interface to monitor mode with airmon-ng start wlan1.

(Update: It looks like a driver or hardware issue. There are some similar discussions like here.)

Penghe Geng

Posted 2013-04-29T19:22:07.287

Reputation: 206

Did you run Wireshark on wlan1 or mon0? Only the latter is a monitor interface. – user1686 – 2013-04-29T19:34:48.123

It's mon0. wlan1 is not even shown in the Wireshark Capture Interfaces dialog. – Penghe Geng – 2013-04-29T19:40:00.893

Answers

1

You're probably capturing on a "protected" network, i.e. one using WEP or WPA/WPA2 encryption, and Wireshark can only dissect the payload of those frames if it has enough information to decrypt them. The "How to Decrypt 802.11" page of the Wireshark Wiki explains this in detail.

user164970

Posted 2013-04-29T19:22:07.287

Reputation:

1No. I am not using any encryption. I just updated my question. And if I were using encryption, I could have at least seen some Data packets. But now if I filter out the AP's beacon message, I couldn't see any packets when I do Ping or telnet. – Penghe Geng – 2013-04-29T19:33:36.663

Asked: 2013-04-29T19:22:07.287

Viewed: 2 803 times

Active: 2019-02-07T23:32:14.423