Wireshark-users: Re: [Wireshark-users] Promiscuous mode on MacBook Pro

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 7 Jan 2010 12:11:31 -0800

On Jan 7, 2010, at 11:42 AM, Daniel Briley wrote:

> My question still stands - Is anyone able to shed some light on why promiscuous mode might not work in my situation?

To quote somebody:

	"Not all wireless drivers support promiscuous mode."

and

	"In addition, if your network has any form of encryption (WEP, WPA/WPA2), while the adapter might be able to, in promiscuous mode, *capture* all traffic on your local network, it probably won't be able to *decrypt* it (that being the whole point of encrypting wireless traffic), and might well just drop those packets on the floor for that reason."

Neither of those are "this is definitely the answer", but they at least suggest a *possibility* for the answer.

Try capturing in monitor mode (select 802.11 or 802.11+radiotap headers), and use the filter

	type data and not broadcast and not multicast and not host {your wireless adapter's MAC address}

to see whether that captures any traffic for other hosts (use that filter rather than the one I mentioned in an earlier message).