By default, the mode is “ Managed,” which means that it is a client or station mode.“IEEE 802.11” is the indication for the Wi-Fi interface.In this example “wlp2s0” is the interface name for the Wi-Fi card. The following screenshot shows the output of this command: To check whether you meet this requirement, open the terminal using the shortcut Alt+Ctrl+T and run the command “ iwconfig.” This output should show if there is an operable Wi-Fi interface. Setup Checkīelow are the requirements for capturing Wi-Fi packets using Wireshark. There are some steps to be followed to achieve this. To follow this article, first, you should learn the basics of WireShark in the Wireshark Basic article, and then you can come back here.

And you have just located the password and username you have entered on the unprotected login page - whether or not the password and username are correct are irrelevant.In this article, you will learn how to capture wireless frames using Wireshark in Linux (Example: Ubuntu.

Once you get there look in the red text paragraphs and try to find what I was able to locate in the picture. Then you will right click on it and go down to 'FOLLOW' then to 'TCP STREAM'. You can see exactly what I am talking about if you follow the pictures above. Then at the far right of the packet in the info section you will see something like '.login' or '/login'. This drastically narrows the search and helps to slow down the traffic by minimizing what pops up on the screen. By filtering this you are now only looking at the post packet for HTTP.

Wireshark comes with the option to filter packets. HTTP (Hyper Text Transfer Protocol) is the protocol we will be dealing with when looking for passwords. The second step to finding the packets that contain login information is to understand the protocol to look for.

Use wireshark to sniff wifi traffic