Windows, by definition, does not allow users to put their interface into 'Monitor Mode'. The problem comes down to our friends at Microsoft, at least historically. AND you have Microsoft Windows, then this article is for you. If, on the other hand, you want to put the NIC into monitor mode to listen to EVERYTHING - control and management frames, beacons, Clear to Send, Request to Send, Association, Disassociations, etc. If that is good, you can stop reading here. In a sense, Wireshark is lying, but it is not Wireshark's fault. Then if I do a display filter for WLAN traffic, we see nothing shows up, because this is not perceived as Wi-Fi traffic. In the video above, I capture on my Wi-Fi interface, and after stopping the capture so we can examine the packets, we see that they are labelled by Wireshark as Ethernet, not Wi-Fi. Wireshark allows capture of normal Wi-Fi data traffic with your Wi-Fi NIC in managed mode – however it just looks like Ethernet traffic (even though it isn't). THIS IS ONLY ABOUT ALSO CAPTURING THE Wi-Fi CONTROL AND MANAGEMENT FRAMES – for example if you wanted to capture IP or TCP (in other works Layer 3 and up) traffic between your system and another system, to Wi-Fi this is considered Data traffic. This article will explain the challenges and the solutions to capturing all Wi-Fi traffic including WLAN control and management frames using a Windows system without paying anyone any money for expensive interfaces or software. Our Udemy course on Wireless Packet captureĪs many of my clients and students know, I have always been astonished at how hard it is to capture the Wi-Fi traffic in Windows. Our Wireless custom profile for Wireshark 5 of 5 - 5 votes Thank you for rating this article.Ĭheck out these great references as well:

Wlan wireshark windows