First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question
0

Why cant I see SSDP protocol packets when using Wifi Monitor mode on Ubuntu

  • retag add tags

I'm looking to snoop on an SSDP conversation between two devices on Wifi. I've set up a WireShark instance on a Ubuntu machine and configured a "Monitor" device using these instructions: https://sandilands.info/sgordon/captu...

However when I now capture via the mon0 device I only see 802.11 protocol packets and can't see any SSDP packets

I had tried just ticking the the "monitor" box on the interfaces list but it would not stay "ticked". The output of iw dev is:

phy#0
        Interface mon0
                ifindex 4
                wdev 0x2
                addr c8:f7:33:8a:dc:07
                type monitor
                txpower 15.00 dBm
        Interface wlp2s0
                ifindex 3
                wdev 0x1
                addr c8:f7:33:8a:dc:07
                type managed
                channel 2 (2417 MHz), width: 20 MHz, center1: 2417 MHz
                txpower 15.00 dBm

Is there away to capture a SSDP conversation in Monitor mode?

ianc's avatar
5
ianc
asked 2018-01-13 14:24:20 +0000, updated 2018-01-13 14:26:05 +0000
edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

1 Answer

0

You are likely capturing this traffic, but you can't see it because it is encrypted. To decrypt:

https://wiki.wireshark.org/HowToDecry...

There could be other root causes of your issue, but with the limited information I think this is the most likely cause. Be sure you are on the correct channel.

Bob Jones's avatar
1.5k
Bob Jones
answered 2018-01-13 14:43:13 +0000
edit flag offensive 0 remove flag delete link
more

Comments

I cheated and just turned off encryption. I wouldn't recommend it as an approach but I live in the countryside :-)

ianc's avatar ianc (2018-01-13 16:42:43 +0000) edit
more
  • delete
add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer