Member Avatar for Octet

Hello Daniweb,

I've recently become interested in networking, especially the administrative side of it (monitoring them, managing and resolving faults etc.) and therefore I thought one of the best ways I could learn was to see what was actually happening on them.

I installed Wireshark for Ubuntu, and everything seems to work fine when monitoring my own traffic. The problem I am facing is, when setting the Wireless Adaptor to 'Monitor' mode so that I can view what is happening on the rest of my network, it shall run for a couple of seconds before crashing with the error:

Unknown message from dumpcap, try to show it as a string: Can't restore interface wlan0 wireless mode (SIOCSIWMODE failed: Operation not permitted).
Please adjust manually.

and

The network adapter on which the capture was being done is no longer running; the capture has stopped.

I don't really know what the problem is, the Wireshark output is just filled with tens of thousands of messages from a wireless printer before the adapter fails. If I end it manually before the adapter crashes, it shall still show up with the same errors.

My guess is it can't put it back into Managed mode, however I don't know why it crashes when running.

Any help would be greatly appreciated!

Thank you

Edited by Octet
  • 3 Contributors
  • 4 Replies
  • 2K Views
  • 1 Year Discussion Span
  • Latest Post Latest Post by Prtablegm

Dani AI

Generated

the SIOCSIWMODE error usually shows up when dumpcap tries to flip wlan0 between managed and monitor while NetworkManager/wpa_supplicant or the driver fights it, or when dumpcap lacks CAP_NET_ADMIN. Easiest fix: create a separate monitor interface and capture on that so Wireshark never toggles wlan0 at all.

sudo iw dev wlan0 interface add mon0 type monitor
sudo ip link set mon0 up
sudo iw dev mon0 set channel <AP_channel>

Select mon0 in Wireshark; when done, sudo iw dev mon0 del. This avoids the restore step that is failing. The iw monitor workflow above is the kernel-supported way to do this. (wireless.wiki.kernel.org)

Seeing only beacon frames after enabling airmon-ng is expected if you are on the wrong channel or your network uses WPA/WPA2 and Wireshark cannot decrypt data frames. Lock the monitor interface to your AP’s channel, then add your WLAN key in Wireshark and capture the client’s 4‑way handshake; without that handshake, unicast traffic will remain opaque. In Wireshark: Edit -> Preferences -> Protocols -> IEEE 802.11 -> check “Enable decryption,” add a wpa-pwd or wpa-psk entry, and reconnect a client while capturing (filter on eapol to confirm). (wireshark.org)

the “unspec” encapsulation you noticed is normal in monitor mode: you are getting raw 802.11 frames (often with radiotap), not Ethernet. That link-type change is expected. (wiki.wireshark.org)

Two more reliability tips echoing : verify your adapter/driver actually supports monitor mode (iw list -> “Supported interface modes: monitor”), and avoid running Wireshark as root. On Ubuntu, allow non-root capture by granting dumpcap capabilities and the wireshark group; this both hardens your setup and reduces odd mode-change failures:

sudo dpkg-reconfigure wireshark-common
sudo usermod -aG wireshark $USER
sudo setcap cap_net_raw,cap_net_admin+ep /usr/bin/dumpcap

Details on why this is the recommended approach are in the Wireshark docs. (wireshark.org)

Only capture on networks you own or have permission to monitor.

Member Avatar for Octet

After a bit of researching I believe the issue is now related to Libpcap, however even when compiling the latest version of it I am still having issues.

Placing the card in monitor mode via the terminal manually also seems to cause it to stop.

Edited by Octet
Member Avatar for Octet

I've managed to keep it in monitor mode with the use of the Airmon-NG Script, however all I see is a load of beacon frames and no other packets, not even from my own computer (the one running Wireshark).

Could someone please explain why this is?
Thanks

Member Avatar for dscherrer

I have also had this problem: Setting the interface to promiscuous mode using ifconfig and then running tshark led to the error message you mentioned. Somehow my interface went from ethernet encapsulation to "unspec" encapsulation during the the capture.
Some experimentation led me to the following solution: Use iwconfig, eg:
iwconfig wlan0 mode monitor to to capture all traffic instead of ifconfig wlan0 promisc
The transition from ethernet to unspecified encapsulation still occurs but it seems to not be harmful anymore...

Member Avatar for Prtablegm

I feel like a grave digger on this topic , but here we go for anyone else. Not all chipsets are the same , to better understand what I mean is that there are some wireless cards that just cannot do what you want it to do. Go to http://www.aircrack-ng.org/doku.php?id=compatibility_drivers .
There you will find what wireless cards can do what etc. The wireless card does make the difference.

Portablegamemaster

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.