1

enter image description hereI am working in Wireshark, to capturing WiFi traffic. Our product is qber management system, its a token management system. So I want to test the whenever calling from API's using with Wireshark to monitoring data inside the packets. My aim is to capture the data from inside the packets. So I need to use with Wireshark.

Firstly, I use the follwoing command:

sudo su
airomon-ng start wlp6s0
then click on mon0 interface

I found that 802.11 management frames, it like beacons, probes.. It showing that the WiFi is in monitor mode.

I saw the so many wireless router names. And also saw the mac address, that I can see the where the request is come from which machine. I saw the data is showing uncomplete...

I want to know Is I am going the right path? or I want to use with airpcap adapter. Which is the approach everyone following? How to get data inside packets when I am testing my API's anyone please help me to clear me.. Help me to go the right way..

| improve this question | |
  • You're falling back into your old, bad habits of just asking the same question again if you don't like the previous answer (sqa.stackexchange.com/questions/25398/…), or tweaking the question slightly as you learn more. It sounds like you want to know generically how to monitor network traffic from multiple WiFi clients, which is way beyond the scope of this StackExchange (and really too general of a question for the Q and A format) – ernie Feb 13 '17 at 5:28
  • @ernie Still I'm in stuck around one month. I couldn't able to find a right solution " how to monitor network traffic from multiple WiFi clients" – toastmaster Feb 13 '17 at 5:31
  • 5
    I'm voting to close this question as off-topic because it is not about testing, but about network engineering used for testing. The question is better asked here: networkengineering.stackexchange.com – Niels van Reijmersdal Feb 13 '17 at 8:04
2

From what it sounds like, you just need to capture traffic. Capturing packets may be more complicated than what you need to do. If you are the source of the traffic, or you know where it is going, using a transparent proxy would get you what you need. If this is HTTPS traffic, it gets much more complicated.

If you have to sniff on the network at the packet level, with an unknown source, you will need to be in monitor mode, as you don't want to be broadcasting. You don't usually need any kind of special adapter for this, many different chips will allow you to enter monitor mode like you are doing with airpcap. Once capturing traffic, you will want to filter to remove all the other chatter, by focusing on the destination address, since I'm guessing the traffic may originate from multiple sources.

Incomplete packets or handshake sequences can pop up for many reasons. Monitoring, scans, poorly designed network services, bandwidth issues, etc. They're only a concern if they're coming/going from the server receiving API traffic or the client sending it.

| improve this answer | |
  • Please see this picture . This is I open the mon0 interface.I think it is in monitor mode, because of 802.11 management frames. Here data is showing incomplete. Please help me am I am going the right way ? – toastmaster Feb 12 '17 at 8:40
  • Here no showing any ip address and I can the mac address where the request is come from which machine – toastmaster Feb 12 '17 at 8:42
  • Ah, I see. If this network has a pass phrase (wpa/wpa2 for instance), then you'll need to authenticate to the network while running Wireshark to get it to read the traffic. Maybe try disconnecting from the network, start Wireshark, then reconnect. Then you should see higher level traffic instead of just things wrapped in 802.11 – maznika Feb 12 '17 at 10:07
  • am I going the right way ? – toastmaster Feb 12 '17 at 11:36
  • then what should I do ? How to see the ip address of each machine ? Where to see the data inside the packets? when I testing api's I want to capture the data inside the packets this is my goal .please help me... – toastmaster Feb 12 '17 at 11:39

Not the answer you're looking for? Browse other questions tagged or ask your own question.