I mean, I just want to put my wireless card interface into promiscuous mode to scan my wireless network I'm connected to. Do I necessarily need a monitor mode wifi card compatible?
Should I necessarily set my interface promiscuous flag on before running Wireshark using its promiscuous mode?
sudo ip link set wlan0 promisc onI've already tried that without having a monitor compatible card without success. I only recieve broadcast and multicast packets.
1 Answer
(Disclaimer: May contain errors. Please fix if you know the networking stuff better.)
Promiscuous mode doesn't imply monitor mode, it's the opposite:
"Promiscuous mode" on both WiFi and Ethernet means having the card accept packets on the current network, even if they're sent to a different MAC address.
"Monitor mode" is WiFi-specific and means having the card accept packets for any network, without having to be associated to it.
Note that both modes only tell the card to accept packets – they don't tell the upstream network to send packets in your direction. Ethernet switches normally won't send packets through your port (or your WiFi AP's port) if they know that the recipient is actually connected to another port.
Finally, every network sniffer out there – including Wireshark – will enable promiscuous mode automatically. Monitor mode, however, needs to be enabled manually as it's often driver-specific, and yes, many cards don't support this mode. (I've had good luck with Atheros ath9k series.)
The airmon-ng script from aircrack-ng tries to detect the current driver, but for a start you can try:
iw <device> interface add mon0 type monitor(where <device> is either the network interface like wlan0 or the physical device like phy0) to create a separate monitor-mode interface. Note that if you remain associated to an AP on wlan0, then you'll only see packets on the same frequency/channel even in monitor mode.
