Compared to Ethernet, the 802.11 network is even 'broader', as the transmitted packets are not limited by the cable medium. In this case, you won't see any 802.11 management or control packets at all, and the 802.11 packet headers are 'translated' by the network driver to 'fake' Ethernet packet headers.Ī 802.11 LAN uses a 'broadcast medium', much like (the mostly obsolete shared) Ethernet. Without any interaction, capturing on WLAN's may capture only user data packets with 'fake' Ethernet headers. traffic between two or more other machines on an Ethernet segment, or are interested in 802.11 management or control packets, or are interested in radio-layer information about packets, you will probably have to capture in 'monitor mode'. If you're trying to capture network traffic that's not being sent to or from the machine running Wireshark or TShark, i.e.

network traffic from that machine to itself, you will need to capture on a loopback interface, if that's possible see CaptureSetup/Loopback.) (If you're trying to capture network traffic between processes running on the machine running Wireshark or TShark, i.e. If you are only trying to capture network traffic between the machine running Wireshark or TShark and other machines on the network, are only interested in regular network data, rather than 802.11 management or control packets, and are not interested in radio-layer information about packets such as signal strength and data rates, you should be able to do this by capturing on the network interface through which the packets will be transmitted and received no special setup should be necessary. The following will explain capturing on 802.11 wireless networks ( WLAN).

Use wireshark to sniff wifi traffic