How to monitor traffic passing through my Wi-Fi access point

Question

I know how to monitor the network interfaces on my local computer with Wireshark. But, how do I monitor the traffic flowing through my wireless access point from connected computers?

It seems like this might not be possible without some kind of special software on the wireless access point itself.

Solution

You will have to put your wireless interface in promiscuous mode and then run Wireshark on it, that will capture all the wireless data that your interface can hear.

Aircrack-ng has a utility airmon-ng which will create a monitor mode wireless interface. you can also use iwconfig/wlanconfig to put your card in monitor mode, it works for Atheros cards etc.

Comments

[openvpndabest]

i have a broadcom 802.11n Network Adapter, any idea how to put that in promiscuous mode? Also i'm a bit confused, the traffic isn't flowing through my wireless nic, but through the wifi router ap...

[Admin]

(Actually, what you want, and what you get from airmon-ng, is monitor mode, which is different from promiscuous mode.) Try using airmon-ng to put your Broadcom interface into monitor mode; it might work. Note that monitor-mode traffic on protected (WEP or WPA/WPA2) networks will be encrypted; you might have to decrypt it - see, for example, Wireshark's page on that.

[Admin]

Monitor-mode capturing will capture traffic sent to and from your access point. Yes, capturing traffic as it flows inside the access point would probably require special software/firmware on the access point itself, unless your access point has such a feature.