Tips on wireless sniffing

We posted some new articles on cisco.com, on the subject of getting a wireless
packet capture. The main focus is to help Cisco customers collect captures so
that we can troubleshoot their problems, but these tips may be generally useful.

https://supportforums.cisco.com/docs/DOC-19232

Please let me know if you see any errors.

Aaron

On 10/26/2011 12:29 PM, Aaron Leonard wrote:
> We posted some new articles on cisco.com, on the subject of getting a wireless
> packet capture. The main focus is to help Cisco customers collect captures so
> that we can troubleshoot their problems, but these tips may be generally useful.
>
> https://supportforums.cisco.com/docs/DOC-19232
>
> Please let me know if you see any errors.
>
> Aaron

Technically, isn't a packet sniffer strictly passive? If so, then the
comment about the sniffer using a transmitter doesn't make sense.

No mention of wireshark. Is netmon better?

>On 10/26/2011 12:29 PM, Aaron Leonard wrote:
>> We posted some new articles on cisco.com, on the subject of getting a
wireless
>> packet capture. The main focus is to help Cisco customers collect captures
so
>> that we can troubleshoot their problems, but these tips may be generally
useful.
>>
>> https://supportforums.cisco.com/docs/DOC-19232

>Technically, isn't a packet sniffer strictly passive?

Yes.

>If so, then the
>comment about the sniffer using a transmitter doesn't make sense.

If you're referring to 1) in https://supportforums.cisco.com/docs/DOC-19136 -
then that's not quite what it says there. Maybe we could word it better.

>No mention of wireshark. Is netmon better?

OK, let's break this down ...

* Wireshark actually works well in Mac OS X 10.7 to do a wireless sniff, and in
fact our doc https://supportforums.cisco.com/docs/DOC-19212 gives some examples

* Wireshark also can be used in Linux to do a wireless sniff ... we decided not
to document anything in this area however, because there are so many variants of
Linux, not to mention driver issues.

* With Windows, however, Wireshark normally *can't* do a wireless sniff. The
exception is with the AirPcap adapters from Riverbed (nee CACE). (It would be
ideal if Wireshark could be enhanced to hook into the Windows 7 driver API for
promiscuous wireless ... but on the other hand, as Riverbed is a sponsor of
Wireshark's ...)

Thus, when it comes to "free" wireless sniffing in Windows 7, Netmon is the only
game in town. I'm not too thrilled about the user interface, but it does
usually work pretty well (modulo whatever the capabilities of the underlying
adapter may provide.)

Thanks for the feedback.

Aaron

Aaron Leonard <Aaron@Cisco.COM> wrote:

> We posted some new articles on cisco.com, on the subject of getting a
> wireless packet capture. The main focus is to help Cisco customers
> collect captures so that we can troubleshoot their problems, but these
> tips may be generally useful.
>
> https://supportforums.cisco.com/docs/DOC-19232
>
> Please let me know if you see any errors.

https://supportforums.cisco.com/docs/DOC-16398

"Note that, even though Netmon 3.4 is supported with XP SP3 and Vista,
it supports wireless sniffing only if running Windows 7."

Netmon (3.4) does monitor mode wireless sniffing fine in (64-bit) Vista
on my Macbook early 2009 with the Apple driver from Boot Camp. Wirelss
card is Broadcom BCM43xx 1.0 (5.10.91.22) - as seen in System Profiler
in OS X 10.5.8.


--
Not him on Facebook

>> We posted some new articles on cisco.com, on the subject of getting a
>> wireless packet capture. The main focus is to help Cisco customers
>> collect captures so that we can troubleshoot their problems, but these
>> tips may be generally useful.
>>
>> https://supportforums.cisco.com/docs/DOC-19232
>>
>> Please let me know if you see any errors.
>
>https://supportforums.cisco.com/docs/DOC-16398
>
>"Note that, even though Netmon 3.4 is supported with XP SP3 and Vista,
>it supports wireless sniffing only if running Windows 7."
>
>Netmon (3.4) does monitor mode wireless sniffing fine in (64-bit) Vista
>on my Macbook early 2009 with the Apple driver from Boot Camp. Wirelss
>card is Broadcom BCM43xx 1.0 (5.10.91.22) - as seen in System Profiler
>in OS X 10.5.8.

Thanks Axel; I've updated the article accordingly.

Btw, Netmon 3.4 also captures some interesting wireless packets when
used in non-promiscuous mode, on an adapter in production use. At
least on my Intel 6300, I get to see some beacons and
probe/authentication/association responses from the AP (although
not the probe/authentication/association requests that I'm sending out.)

(Writing that up is on the to-do list.)

Cheers,

Aaron