5

I have pretty much exhausted every link I have found on google regarding this topic, and I'd like some of the most experienced eyes on the problem, because something obscure must be going on.

Systems tested on:

  • VirtualBox 4.1.22 VM: Ubuntu 12.10 x64
  • VirtualBox 4.1.22 VM: Ubuntu 10.04 x64
  • VirtualBox 4.1.22 VM: Backtrack 5 r2
  • VirtualBox 4.1.22 VM: Backtrack 5 r3
  • Lenovo W530 laptop running Backtrack 5 r2

Interface:

Alfa AWUS036H - FCC ID UQ2AWUS036H (you can verify RTL8187L chipset at http://transition.fcc.gov/oet/ea/fccid/. Enter grantee code: UQ2, product code: AWUS036H, then clicking "detail" and then "internal photos").

Problem description

The problem is that while I'm running wlan0 in monitor mode, I only see broadcast packets (I see ARPs, DHCP transactions, beacons, and other random management and data packets that are being broadcast or multicast). This is the case in kismet, wireshark 1.2.x, 1.4.x, and 1.8.x, and my own packet reader program that uses libpcap. The clients that I have set up running pings and http traffic are connected to an open wireless g network. The computer I am sniffing from is not connected to any network.

Procedure

I have tested more configurations than I can list, but I'll try to give a good idea of what I've done.

The USB wireless card I listed (Alfa AWUS036H) is using the rtl8187 driver. Relevant commands and their outputs are listed below:

# lsusb
Bus 001 Device 009: ID 0bda:8187 Realtek Semiconductor Corp. RTL8187 Wireless Adapter
Bus 001 Device 007: ID 80ee:0021  
Bus 001 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub

# lsmod|grep 80211
mac80211              238928  1 rtl8187
cfg80211              148725  2 rtl8187,mac80211

I've made sure the wireless card is on channel 6, the same channel my open network is on. I have tried both putting wlan0 into monitor mode manually using:

# ifconfig wlan0 down
# iwconfig wlan0 mode monitor
# iwconfig wlan0 channel 6
# ifconfig wlan0 up

And also using airmon-ng to create a mon0 device:

# airmon-ng start wlan0 6
Interface   Chipset     Driver

wlan0       RTL8187     rtl8187 - [phy5]
                (monitor mode enabled on mon0)

When using iwconfig, I can verify wlan0 is in monitor mode:

wlan0     IEEE 802.11bg  Mode:Monitor  Frequency:2.437 GHz  Tx-Power=27 dBm   
          Retry  long limit:7   RTS thr:off   Fragment thr:off
          Power Management:off

When I use iwconfig to put the card into monitor mode manually, I use the interface wlan0 in wireshark and kismet. When using airmon-ng to create a mon0 interface that is in monitor mode, I use mon0.

In both cases, I get the same result: kismet and wireshark will see all the broadcast packets from the APs around me, but never any ICMP or HTTP traffic I'm creating from other clients in order to test.

I am not associated or authenticated to any AP. I did this a few months ago at a workshop and it worked great; we saw tons of HTTP traffic flying around.

For most of the same type of questions I've seen asked elsewhere, the problem had to do with the person being associated to a network or that they were on an encrypted network and weren't entering the key properly. I cannot find any issue with the setup or the device. Any ideas?

Thanks for any help.

Improve this question
2
  • Are you monitoring inside a VM?
    – bahamat
    Oct 4, 2012 at 22:18
  • In the case of the first 4 test setups, yes. The usb wireless card is seen and used just fine in the VMs. But I do have a backtrack r2 x64 distribution installed on my lenovo laptop that I booted to and used directly. Same results, so I figured it wasn't VM related.
    – fortenbt
    Oct 5, 2012 at 1:25

2 Answers 2

Reset to default
3

Look at your post, especially the message

(monitor mode enabled on mon0)

So... capture on mon0, NOT wlan0!

ie:

airmon-ng start wlan0
airodump-ng mon0

.. you'll notice no channel-hopping. You'll need a workaround to get it grabbing the full spectrum! Sooo...

airodump-ng mon0

airmon-ng stop wlan0      # gets channel hopping going (but obviously stops wlan0)

airodump-ng mon0
Improve this answer
0

I have a similar problem using a USB Realtek RTL8188 chip in monitor mode. MON works fine when I switch to an internal Intel Centrino 1030 chip. I need a cheap USB wifi for a project I'm working on so I'm trying out a couple cheap USB plugs.

I took away a number of variables by bringing up the links from the commandline using man:iw for wireless setup and monitoring, man:ifconfig for static IP link and man:route for gateway.

Traffic flows fine on both wlanX interfaces. On the RTL8188 mon i/f beacons, some broadcasts (not ARP!) and 802.11 QOS frames are seen. Everything (broadcast, beacon, HTTP, IMAP, etc.) are seen on the 1030 mon interface.

I emailed with the OEM engineers and they said the RTL8188 supports monitor mode but not in their product.

I understand the Alfa USB plugs DO support monitor mode but vbox may not be passing that control information through.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.