ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-users: [Wireshark-users] sniffing 802.11 wireless traffic (beacons)

Date Prev · Date Next · Thread Prev · Thread Next
From: "Mark Ryden" <markryde@xxxxxxxxx>
Date: Sun, 30 Nov 2008 15:39:20 +0200
Hello,

I have a question about sniffing 802.11 wireless traffic;
I am running wireshark-1.0.0-2 on Fedora Core.
I had set my wireless nic (ZD1211) to be in monitor mode;
iwconfig wlan0 shows:

wlan1     IEEE 802.11  Mode:Monitor  Frequency:2.412 GHz  Tx-Power=0 dBm
          Retry min limit:7   RTS thr:off   Fragment thr=2352 B
          Encryption key:off
          Link Quality:0  Signal level:0  Noise level:0
          Rx invalid nwid:0  Rx invalid crypt:0  Rx invalid frag:0
          Tx excessive retries:0  Invalid misc:0   Missed beacon:0

I had started sniffing with wireshark by selecting wlan1 in
capture->options (and also selecting
promiscuous mode).
I can sniff only probe requests packets. Any idea why I cannot see beacons from
an Access Point ? There is an Access Point near me to which I can
associate from
other machines near me (and also from my machine when changing to managed mode).
It seems strange to me, because I scan for more than 5 minutes and
no beacon fragments. (As far as I know, an access point sends usually 10
beacons per second, or more )

What could be the reason? I simply don't believe that an Access Point does
not send beacons!

Regards,
Mark