Wireshark: capturing in monitor mode from rt2800usb chipset

Wireshark would not allow me tick the box for “Monitor mode” (it auto-disabled itself again), and “sudo iwconfig wlan0 mode Monitor” says “device busy”. However, using airmon-ng to enable monitor mode worked: sudo airmon-ng start wlan0 {channelnum} (the channel number might be optional) gives a second mon0 interface which allows capturing in monitor mode just fine – at least if I disabled the use of encryption for the wireless network. I didn’t manage to convince Wireshark to decyrypt WPA2.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s