0

tcpdump -i mlan0 -n

tcpdump: verbose output suppressed, use -v or -vv for full protocol
decode listening on mlan0, link-type EN10MB (Ethernet), capture size 262144 bytes

Why is this Ethernet here? I am using wifi, not an Ethernet.

decode listening on mlan0, link-type EN10MB (Ethernet), capture size 262144 bytes

I'm not sure how I can research this. I can find man pages on tcpdump usage. But nothing to explain this particular line.

1

Why is this Ethernet here? I am using wifi, not an Ethernet.

Because you're not capturing in monitor mode; on most operating systems, the only way to get 802.11 headers, rather than fake Ethernet headers, on a Wi-Fi capture is to capture in monitor mode. This includes Linux, OS X, and Windows (although WinPcap doesn't currently support monitor mode).

If you only want to see traffic to and from your machine, you can capture without monitor mode. You won't see packets other than data packets.

If you want to see other traffic on your network, or want to see non-data packets, or want to see 802.11 headers, or want to see 802.11 headers and radio information (data rate, signal strength, etc.), you need to capture in monitor mode. However, in monitor mode, packets on a protected network (network using WEP or WPA/WPA2) will not be decrypted; Wireshark can decrypt them if you supply the network's password and, if the network uses WPA/WPA2, if you've captured the initial EAPOL handshakes for each device whose traffic you want to decrypt.

  • +1 Awesome answer. I've been busy with trying to diagnose a wifi connection problem and i came across this and it confused me. – David Nov 18 '14 at 6:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.