Member Avatar for IamI

Hi,

I have an ASUS N53SV laptop with an Atheros AR9002WB-1NG Wireless Network Adapter. I would like to monitor WIFI networks using WireShark or other programs. However, I'm encountering a problem that I only see my own traffic. I've found that the card has to be in monitoring mode in order to capture packages not directed to me. I'd like to know if monitoring option is available for this card on Windows or Linux and if so, how should I configure it? I already have WinPCap installed on my computer.

Thank you for information.

Edited by IamI because: n/a
  • 3 Contributors
  • 8 Replies
  • 483 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by jingda

Dani AI

Generated

Short answer: yes — the AR9002WB-1NG in many Asus notebooks is the Atheros/Qualcomm mini‑PCIe card that maps to the AR9xx family and is supported by the in‑kernel ath9k stack on Linux (monitor mode is a supported mode). On Windows you generally cannot get full 802.11 “monitor” captures with legacy WinPcap; Npcap (installed with the “Support raw 802.11 traffic” option) can expose monitor mode when the driver/hardware implements it, but results vary. (wireless.docs.kernel.org)

Practical Linux workflow (what actually works for most laptop cards):

# identify the card and driver
sudo lspci -nnk | grep -iA3 '\(network\|wireless\)'

# stop userspace daemons that interfere
sudo airmon-ng check kill

# have airmon-ng create a monitor interface
sudo airmon-ng start wlan0

# or create monitor mode manually
sudo ip link set wlan0 down
sudo iw dev wlan0 set type monitor
sudo ip link set wlan0 up

If airmon-ng succeeds you’ll see a new interface like wlan0mon; use that in Wireshark/airodump. (manpages.debian.org)

Troubleshooting tips: confirm the kernel driver in use (lspci -nnk) and lsmod | grep ath9k; check dmesg for firmware/driver errors. If the driver is not ath9k (or the card presents a different chipset id), update your kernel or use vendor/backports that include ath9k fixes. If captures show only your traffic, ensure you actually have a monitor interface (check iw dev) and that NetworkManager/wpa_supplicant were stopped (that’s what airmon-ng check kill does). (wireless.docs.kernel.org)

Windows options: install Npcap with the “raw 802.11” option and use its WlanHelper tool or Wireshark’s monitor checkbox — but expect more variability than Linux and possible driver limitations. If you need reliable monitor/injection capability for auditing, a supported USB adapter (with a known chipset) or booting a Linux live distro is the simplest path. Also heed ’s point: capturing others’ traffic can be illegal — verify local law and only capture networks you own or have explicit permission to test. (npcap.com)

Recommended Answers

All 8 Replies

Member Avatar for L7Sqr

Are you sure what you are trying to do is legal?

Member Avatar for IamI

Yes. I won't use it for malicious purposes.

PS: I meant capturing packets not capturing packages :)

Edited by IamI because: n/a
Member Avatar for L7Sqr

What I mean is, in many places capturing frames not destined for you is considered illegal (regardless of your intent) unless you have consent or a court order. See the ECPA. Specifically:

Title III prohibits the use of pen register and/or trap and trace devices to record dialing, routing, addressing, and signalling[sic] information used in the process of transmitting wire or electronic communications without a court order.

Member Avatar for IamI

Well, I live in Europe, I'm not sure how this is controlled here. Anyway, I only want to see this working, I do NOT intent to hack into others' private network. It might be in the "grey area" of law. And you shouldn't forget Google has gone a lot further.
So please, if you can, do help me! Thank you.

Member Avatar for L7Sqr

I'd suggest that first you determine the specifics of this behavior in your location and based on that take further action. I do not know the specifics so I can not help you anymore. Sorry.

One other thing to keep in mind, however, is that your intent is irrelevant when considering your actions. What I mean is that if it is illegal to capture packets not destined to you and you do so anyway then you have broken the law. It doesn't matter if ultimately you never had malicious goals.

Member Avatar for IamI

I completely understand your point of view. I am also aware, that this might not be considered 100% legal independently from my intents. But also, if nobody sees, nobody cares :). That's why I was saying "grey area".

Member Avatar for IamI

Any idea? I'd only like to know, whether and how I can enable packet capturing with my card.

Member Avatar for jingda

YOu want to see other traffics and networks data packets that does not belong to you. Am I right?

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.