Tcpdump/Wireless

Info on using Tcpdump for wireless packet captures.

Wireless Tcpdump

If you want to capture wireless packets, you need to know a bit more about a few things.

First is channels.

The 802.11 protocol allocates 12 channels for wireless (in the US), and your wireless card can only listen to one channel at a time. To listen to twelve channels, you need twelve wireless cards - or you need to hop from channel to channel with your single wireless card.

If it is critical to capture all traffic, you will want to use multiple wireless cards - if you're hopping from channel 5 to channel 6, and traffic shows up on channel 4, you won't see it.

Second is monitor mode. If your wireless card is not in monitor mode, your wireless card will be throwing away any packets that are not intended for itself, meaning you'll only be creating a pcap file of your own traffic.

Platforms

Mac: Tcpdump/Wireless/Mac

Linux: Tcpdump/Wireless/Linux