HTTP packet not showing in monitor mode (rtl8812au)

edit

The wifi adapter has to be able to pick up the test traffic; the performance envelope has to be as big, or bigger, than the test traffic when it comes to things like spacial streams, bandwidth, MCS Index, and other details like guard interval, LDPC encoding, and distance from the transmitter.

This really applies to the higher modulations (i.e. datarates) that data frames use (usually QoS Data) - control and management traffic is usually sent at low modulations so is easily picked up.

So why do see some, but not all? The transmit datarate is not fixed; there is a selection algorithm to choose the encoding and datarate of any given frame. It is usually up to the max, but the poorer the communications (say signal to noise ratio, etc) the lower the datarate. So I suspect the frames you do see are sent at non-maximum datarates. The rest are sent outside of the performance envelope of your capture system so you miss these frames. However, you probably still see the control frames associated with these, anyway, like ACKs/BlockACKs, CTS/RTS, etc.

The rtl8812 and 8814 USB chipsets seem to have a problem picking up frames sent with a bandwidth greater than 20MHz. Even though they seem to support it at the software level, I can't get either one to pick up 40 or 80MHz frames, though the 8814au tested will do 3SS and LDPC, but must be 20MHz. This could be a configuration issue but my other adapters work with the same setup, so perhaps you are seeing the same thing: the highest datarate frames are missed by the adapter. You should not have any 80MHz traffic on 2.4GHz, and even 40MHz is not good for any type of large, professional installation. You did not say what band you are working on.

To try and pick them all up, limit your bandwidth to 20MHz either at the AP or client side, as a start. Get closer to the transmitter, and have various capture adapters to test with.

Also, the industry moved away from WEP, I don't know, maybe 15 years ago? WEP can be cracked in minutes... I hope this is a test. If not, seriously, time to update long ago.

Funny, though, often APs need to use AES (through WPA2) and WMM to get maximum performance. So a real WEP selection would limit datarates making it much easier to pick up traffic. So something does not seem right - this conflicts with my explanation. But you have not provided enough information to definitely determine the full communications profile to know for sure what is wrong.