You might notice that the channel you set using iwconfig doesn’t take effect. You could use iwconfig to change channels. Now fire up wireshark and start capturing using the mon0 interface. In the above step 11 is the channel number.Īirmon-ng will create the network interface mon0. Optionally, you could also specify which wireless channel to operate in. In the above step, you should replace wlan0 with the name of your wireless network interface. Next we need to create the network interface cconfigured in monitor mode.

sudo setcap 'CAP_NET_RAW+eip CAP_NET_ADMIN+eip' /usr/bin/dumpcap Wireshark uses dumpcap to capture packet data from a live network. To enable capture for regular users, we will have to set the capability string for the dumpcap utility. sudo apt-get install aircrack-ng wireshark libcap2-binīy default, capturing network packets needs root privileges. So lets first install all the software that we need.

Once we have the wireless interface capable of capturing, we can use Wireshark to capture the packets. You can check here, whether your card is compatible or not. Its compatible with most wireless cards that are shipped with the laptops these days. It creates a new network interface which is automatically configured to operate in monitor mode.

We can take the guess work out by using the airmon-ng utility from the wonderful aircrack-ng software suite. That procedure differs from one vendor to other. To be able to capture 802.11 packets, the first step is to figure out how to configure your wireless card to make it operate in monitor mode.

Jotting down an easy recipe to get a 802.11 sniffer working on Ubuntu Linux.

Monitor mode wireshark linux