0

At my home I use a wireless router to connect to internet, so every device uses wireless card to use it.

In this way using sudo tcpdump -i wlan0 from my pc I should be able to see all the packets going around in the local net (thing that I couldn't do if everyone was connected using ethernet) and it looks it works.

Now I tryed sudo tcpdump -i wlan0 host 192.168.1.3 to see only the packets of a specific pc (which is not mine but of another different pc) but I get nothing just:

****@****-pc ~ $ sudo tcpdump -i wlan0 host 192.168.1.3
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on wlan0, link-type EN10MB (Ethernet), capture size 65535 bytes

So I don't understand, why using sudo tcpdump -i wlan0 I see everything but I can't say to just track one specific flow?

6
  • 1
    I'd rectify that not tcpdump do you put in promiscuous mode but the network card you order it to sniff through. What does sudo tcpdump -i wlan0 | grep '192\.168\.1\.3' yield? – user86969 Mar 6 '15 at 12:40
  • Is your wireless router configured as "bridge" or as a "router"? The difference between one and the other is that, bridge will make all physical media as one(wireless and ethernet), and routing, you will be closed to a broadcast domain an you will probably not see packages coming from ethernet hosts. – user34720 Mar 6 '15 at 13:38
  • @nwildner Bridge/router mode controls how packets are relayed between the LAN and WAN, it shouldn't affect LAN-LAN traffic. But if the router or access point acts as a switch, it won't reflect packets out to all interfaces. – Barmar Mar 6 '15 at 23:32
  • I'm having trouble understanding the question. Are you seeing traffic for other hosts or not? – Barmar Mar 6 '15 at 23:33
  • @Barman. Some WiFi routers allow you to isolate L2 from Ethernet and Wireless connections and the dhcp on those will deliver different ip ranges. And yeah, I found this question a little confusing too... – user34720 Mar 6 '15 at 23:41
1

Many wireless cards will refuse to be set to promiscuous mode. (There are exceptions but these are relatively rare.) Without seeing a text dump of your capture it's impossible to be sure, but it's likely that all you're seeing from your tcpdump is normal broadcast traffic. As a consequence, when you ask to see traffic for a particular host you will see nothing except its broadcast traffic, of which there should be very little.

0
0

Because the NIC may filter out the packets which are not addressed to your pc by MAC address, and so may any routers the packet passes through. A WiFi Router is also a switch and/or a router (depending on configuration).

For information, a switch works on the link layer (2nd layer of OSI mode). Routers work on layer 3.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.