Member Avatar for makdu

Hi,
I am trying to find a solution to read the packet destination for an internet connection through wifi. I am able to do the same for a lan connection using packet sniffer example. But the same is not working for wifi connection.

mainSocket = new Socket(AddressFamily.InterNetwork, SocketType.Raw, ProtocolType.IP);

The above code is used for LAN . what is to be done for Wifi Packet Sniffer

  • 2 Contributors
  • 2 Replies
  • 391 Views
  • 12 Hours Discussion Span
  • Latest Post Latest Post by makdu

Dani AI

Generated

Short diagnosis for : the Socket you showed creates an IP‑layer raw socket — that works for some LAN troubleshooting but does not give you 802.11 link‑layer frames from a Wi‑Fi radio, and on modern Windows raw sockets are limited and unreliable for packet sniffing. Wireless sniffing normally requires the adapter be put into monitor (rfmon) mode so you see 802.11 headers; that is a driver/OS capability, not something a plain AF_INET raw socket will provide. (stackoverflow.com)

Practical path for Wi‑Fi captures on Windows: install Npcap (not the old WinPcap) with the “Support raw 802.11 traffic (and monitor mode)” option, confirm your adapter/driver actually supports monitor mode, then capture with Wireshark (use the Monitor Mode checkbox) or dumpcap/tshark where supported. Npcap will supply radiotap/802.11 frames when monitor mode is available; if the adapter doesn’t support monitor mode you can’t sniff other clients from that machine — you’ll need a different adapter or an AP/router capture. Example (on systems where libpcap/dumpcap supports monitor mode): 

dumpcap -D
sudo dumpcap -i <wlan-interface> -I -w wifi-monitor.pcap

See Npcap and the Wireshark capture setup notes for details and tools (WlanHelper, monitor toggles, admin requirements). (npcap.com)

About WCDMA/PPP: capturing PPP control frames on many OSes is special-case and on Windows “capturing on a PPP link is more difficult” — libpcap-style drivers often don’t expose the same headers for PPP. If your goal is simply “what destination IPs are being used”, a Windows‑level packet interception solution (Windows Filtering Platform or libraries like WinDivert) can observe IP packets on PPP interfaces and is often easier than trying to force 802.11/PPP link‑layer captures. Alternatively capture at the gateway/router or run tcpdump on the modem/tethered device. (wiki.wireshark.org)

Troubleshooting checklist: (1) run as Administrator; (2) verify adapter supports monitor mode (Npcap’s WlanHelper or Wireshark’s Monitor checkbox); (3) if adapter fails, try a USB Wi‑Fi adapter known for rfmon support or capture on the AP/gateway; (4) for PPP/WCDMA prefer WFP/WinDivert or gateway captures. ’s pointer was useful — combine that background with the Npcap/Wireshark approach above depending on whether you need 802.11 frames or just IP‑level destinations. (npcap.com)

Recommended Answers

All 2 Replies

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.