2

I am working in wireshark. I am monitoring the wifi traffic on the same network. We have 6 pc's there and one machine was installed on wireshark to capture wifi traffic. I got my team mates Ip address in the endpoint list. My machine have installed wiresahrk. whenever they ping to my machine. my machine ip : 192.168.1.214. and others are: 192.168.1.31, 164,188,242. and they ping a request to my m/c I can capture that request. And if 192.168.1.188 machine send a http request to a local server to other ip like 164, 31 . I couldn't capture that http request. Its hows only mdns protocol.. here is the screenshot..

Why I can't capture the http request ? Why other team mates IP (188-->164.31) was not capture ? Anyone please help me

I am working in ubuntu machine.

My router type is : Belkin Surf N150 Wireless Modem Router, F9J1001 v1.

root@naveen-Inspiron-3542:/home/naveen# airmon-ng start wlp6s0


Found 5 processes that could cause trouble.
If airodump-ng, aireplay-ng or airtun-ng stops working after
a short period of time, you may want to kill (some of) them!
-e 
PID Name
1114    NetworkManager
1117    avahi-daemon
1144    avahi-daemon
1311    wpa_supplicant
7662    dhclient
Process with PID 7662 (dhclient) is running on interface wlp6s0
Process with PID 8073 (dumpcap) is running on interface wlp6s0


Interface   Chipset     Driver

wlp6s0      Atheros     ath9k - [phy0]
                (monitor mode enabled on mon0)

When I click on mon0 interface. I got the 802.11 management frames.. enter image description here

But my question is I can't capture the http request ?

closed as off-topic by Niels van Reijmersdal, IAmMilinPatel, Bharat Mane, Rsf, NarendraC Feb 13 '17 at 10:18

  • This question does not appear to be about software quality assurance or testing within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

4

If I'm reading your question correctly, it sounds like you're expecting this machine running Wireshark to be able to monitor all traffic across the router. Wireshark can't do that since it monitors traffic across the interface, not across the router. You're seeing the MDNS messages since those are multicast DNS broadcasts, and same thing with the pings. They're going directly to the IP/interface on the machine you're running Wireshark.

Put another way, Wireshark will see all traffic going to/from your Ubuntu server across the interface you've configured it to listen on (which sounds like it's at 192.168.1.214). It won't see any traffic that's not going to that IP. The other machines on your network send their traffic to the router, and then to the destination server, never touching the machine you're running Wireshark on.

If you want to monitor all network traffic, you'll likely need to setup a proxy server and monitor traffic there.

  • I edit my post please review – toastmaster Feb 10 '17 at 3:52

Not the answer you're looking for? Browse other questions tagged or ask your own question.