Wireshark-users: Re: [Wireshark-users] How to capture MAC layer packets (Wifi Beacons for instance)

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Sun, 22 Nov 2009 11:20:20 -0800

On Nov 22, 2009, at 9:10 AM, Pedro Rosas wrote:

I am currently working on a project at my university, and I need to capture some 802.11 frames. For instance, I need to capture the Beacons sent from the APs usually every 100ms. When I run Wireshark both on windows 7 and Ubuntu 9.04 I can only capture packets from higher layers (TCP, HTTP, etc.). Is it possible to capture the frames from MAC layers of 802.11? For instance, the beacons?

Yes.

Forget Windows 7, but on Ubuntu, if you can put the adapter into monitor mode, you should be able to see non-data 802.11 frames. (If your adapter's driver is a mac80211 driver, you might be able to capture those on the wmaster interface as well.)