The npcap capture libraries (instead of WinPCAP).

A WiFi card that supports monitor mode.

To get the radio layer information, you need at least three things (other than Wireshark, of course): There’s nothing related to the radio layer, so troubleshooting the wireless connectivity is not possible this way. The 'Capture Options' dialog should include a checkbox for it.Figure 1 – “Wireless” capture without monitor modeĪs you can see, the capture looks just like a normal Ethernet capture would. In Wireshark 1.4 or newer, the use of WiFi monitor mode is optional. Unfortunately, the capabilities of different WiFi chips vary in this regard: some chips can be used to monitor while maintaining a WiFi connection, but many are strictly receive-only when in monitor mode, which obviously makes maintaining a WiFi association impossible. The monitor mode can also provide access to low-level radio interface management traffic and information that may not be available otherwise. In monitor mode, absolutely all packets received from the radio layer are allowed to pass to the host OS and eventually to the application. Although it can receive, at the radio level, packets on other SSID's, it will not forward them to the host.

The Wireshark documentation says:Įven in promiscuous mode, an 802.11 adapter will only supply to the host packets of the SSID the adapter has joined, assuming promiscuous mode works at all even if it 'works', it might only supply to the host the same packets that would be seen in non-promiscuous mode. The classic promiscuous mode is also available with WiFi, but less useful on WiFi interfaces, as any WiFi traffic is normally filtered by SSID at the hardware level.

The most comprehensive way to capture traffic on a WiFi interface is usually the monitor mode.

Wlan wireshark windows