Wireshark does not show wlan traffic of iOs/Android devices (but shows traffic of my others devices)

i am trying to sniff the Wifi traffic of my home network.

for that, i run Backtrack LiveCD on a laptop with a DLINK AirPlus DWL g650 wifi adapter. i set my WPA key in wireshark, and running wlan interface in monitor mode enabled. i started the capture.

I can capture the traffic of my 3 others laptop computers connected with wifi to the AP (two Windows XP and one Vista) with no problem. (Of course, i just had to deauth then reauth the computers in order to capture the EAPOL keys with wireshark)

When i browse something on the laptops, i see the traffic clear (HTTP headers etc..) and see the local IP addresses (192.168.1.x) in wireshark.

but when i connect my 2 phones to the AP. (iphone and android) i can see the EAPOL keys coming in wireshark, but when i browse something on the phone , nothing clear showing in wireshark, not even the 192.168.1.x addresses IP. (i am not connected to the 3G but really to my local network, tried airplane mode with wifi too) and instead of clear traffic i got a bunch of: "IEEE 802 Null function (no data)" entries in wireshark.

Why wireshark can decrypt my PCs traffic but it will not decrypt traffic of android or ios device??

I tried forcing deauth several times with aireplay etc.. and manual deauth/auth got EAPOL, but it's like the traffic isn't decrypted correctly?

i tried with another phone, a Nokia n97, and it works good i can see everything...

just not working with android and ios?

Tobby84

Posted 2014-12-10T15:03:22.333

Reputation:

Answers

Some 802.11n WiFi chipsets (the one your using in monitor mode for frame capture) do not support LDPC or 20MHz Short Guard Interval (SGI).

If that is the case and your AP and the two mobile devices negotiate either of these features (based on which your capture device does not support), their 802.11n traffic will be invisible to your frame capture device.

Alan Klein

Posted 2014-12-10T15:03:22.333

Reputation: 21

...and some 802.11 adapters don't have 802.11n WiFi chipsets at all and thus don't support 802.11n, period, which turned out to be the problem here, as per the original poster's follow-up answer. – None – 2015-09-04T18:25:20.647

I just found the issue and came back here to explain,

My Dlink dwl g650 adapter is 802.11 b/g only, and my router is b/g/n by default.

My android phone and iOS are b/g/n too so the connection to the router is made by default with n mode.

If i force the router to use b/g only mode, it works as I want it to I can capture the iOS/android traffic.

Issue resolved!

Tobby84

Posted 2014-12-10T15:03:22.333

Reputation: 11

You should register your account and contact the team so you get access to your original question: http://superuser.com/contact

– slhck – 2014-12-12T15:58:51.220