Enable Wireless Monitor mode for traffic sniffing

40,191

Finally I found a solution by little research. The problem was really with the device driver I had chosen in Additional Drivers as the image shows in the question. I then selected the second choise in wireless drivers which is "Do not use this device". It doesn't have the meaning it implies, it only does avoid using broadcom wireless STA driver. Then I restarted my machine and I could see my interface as wlan0 (which was previously displayed as eth1).

Then I executed following command (airmon-ng bash script), which I could easily turn wireless card into monitor mode.

sudo airmon-ng start wlan0

enter image description here

It was required to start monitoring mode of the wlan0 interface using airmon-ng script before sniffing. Otherwise when I start a sniff using wlan0 with wireshark(monitor mode enabled in wireshark) I could only sniff few seconds and automatically device disconnects from the network.

Share:
40,191
Deepal
Author by

Deepal

NodeJS Fan and an Information Security Enthusiast

Updated on September 18, 2022

Comments

  • Deepal
    Deepal over 1 year

    I need to sniff all the wifi traffic that I can capture using wireshark in Ubuntu. My wireless interface is named as eth1 in the interfaces list. When I select that interface in Wireshark and start new sniff, I got following error;

    enter image description here

    As this thread says, I tried to installed the mentioned driver but I got an error in installation saying that that driver is not supported by my device. After that I tried the second answer in the same thread and run following command to enable monitor mode in my wireless card.

    echo 1 > /proc/brcm_monitor0
    

    Then I saw a new Ethernet interface (not a wireless interface ) called prism0 in wireshark interface list. I couldn't start a sniff using that interface using monitor mode because in that interface settings, monitor mode check box has been disabled.

    I have installed a broadcom wireless driver in Additional Drivers as follows:

    enter image description here

    Is there an error listing my Wifi interface as eth1 rather than wlan0 in the interfaces list? How can I start my wireless interface in monitor mode for sniffing?

    Thank you.

    • chili555
      chili555 over 10 years
      The correct interface for the Broadcom STA driver is eth1. There is no error.
    • Eliah Kagan
      Eliah Kagan over 10 years
      @chili555 I recommend posting something like that as an answer.
    • Deepal
      Deepal over 10 years
      @chili555, I found an answer myself and posted as an answer :) You are correct. There's no error displaying wlan0 as eth1 with STA driver. :)
  • Deepal
    Deepal over 10 years
    In my case I can see all interfaces in wireshark with no error. I think you need to add your username into wireshark user group, and then you won't need to run wireshark as root. I found the solution for my case by little research and I'll post it as an answer. Thank you very much for replying my question :)
  • guntbert
    guntbert almost 9 years
    Running wireshark as root is definitely not recommended.