Putting network interface in promiscuous mode (not monitor mode)

Question

I'm looking to capture Wifi request probes while still associated with a network and otherwise not affecting that connection.

I can successfully enable monitor mode but, of course, can't join networks while in monitor mode.

I'm assuming that a network interface that supports monitor mode likely support promiscuous mode too, is that an unreasonable expectation?

I've tried running tshark on the interface while associated to a network (it seems tshark makes an attempt to set the hardware in promiscuous mode), but that doesn't capture the packets I'm looking for.

How do I put a wireless interface in promiscuous mode?

Solution 1

DISCLAIMER: I don't know how dependent this answer is on specific hardware.

airmon-ng will enable a monitor interface without disrupting your wifi connection. Install aircrack-ng then run something like (I'm assuming wlan0 here):

sudo airmon-ng start wlan0

Which will typically create a mon0 interface to the same physical card.

You can also try to do it with iw (I'm assuming you are using phy0 here):

sudo iw dev #this will show you the relation between phy's and interfaces
sudo iw phy phy0 interface add mon0 type monitor

Where you will create a mon0 interface to the same physical card. See (http://linuxwireless.org/en/users/Documentation/iw/#Adding_interfaces_with_iw) for more details on using iw.

As far as hardware goes, I usually run Atheros cards, but I've seen both of these techniques work on Broadcom cards as well, with the notable difference that when I had a mon0 interface to a broadcom card, airodump-ng couldn't change the channel.

Solution 2

Try:

ip link set wlan0 promisc on

Comments

[David Chouinard]

Nope, doesn't behave any differently, nor do I see any errors.

[David Chouinard]

Oh, but netstat -i does show the interface flags as BMPRU, where the P stands for promiscuous.

[Wouter Verhelst]

Promiscuous mode means the kernel or network card won't drop packages that aren't addressed to your network card; however, it does not mean that such packages will be sent to your network card, or (if you're using wpa2) that they'll be encrypted to your network card.

[David Chouinard]

Yes, I know. Maybe my question wasn't clear, but I successfully used airmon-ng to set the interface to monitor mode. That works fine. I'm looking to put the card in promiscuous mode, not monitor mode.

[David Chouinard]

Interesting. Yes, that it was I'm trying to do. When I run airmon-ng, the wlan0 interface gets replaced with wlan0mon. The original wlan0 interface is no longer available. If I use wpa_supplicant to connect with wlan0mon, the dump collection stops.

[rexroni]

Have you tried the iw technique? I ask because I'm pretty sure that the airmon-ng source code is actually just a bash script that goes through and tries a bunch of things. It likely tries the iw technique but fails out and tries something else. I think if you manually run the iw technique and it gives you an error, you might be up against a hardware limitation. ... Oh! Also run iw phy and under the "supported commands" see if there's a new_interface command supported.

[David Chouinard]

Wow, that works. Phenomenal. Thank you very much.