Troubleshooting Missing TCP Traffic with Wireshark on Wifi External USBAdapter in Monitor Mode

Troubleshooting Missing TCP Traffic in Wireshark with WiFi External USB Adapter in Monitor Mode

In this article, we will discuss the steps to troubleshoot missing TCP traffic in Wireshark when using a WiFi external USB adapter in monitor mode. This guide is specifically focused on a scenario where an ESP32-C6 is running a small HTTP server, connected to an OpenWRT AP without security (open, resulting in using WPA2, thereby capturing handshake). The WiFi adapter is set to 2.4GHz.

1. Setting up the Environment

Before diving into troubleshooting, make sure your environment is set up properly. Here are the steps:

• Install the latest version of Wireshark on your computer.
• Connect the WiFi external USB adapter to your computer.
• Put the WiFi adapter in monitor mode by running the following command:

airmon-ng start wlan0

Where 'wlan0' is the name of your WiFi interface.

2. Capturing Packets with Wireshark

After setting up your environment, follow these steps to capture packets:

• Start Wireshark.
• Select your WiFi adapter in monitor mode from the list of interfaces.
• Start the capture.
• Access the ESP32-C6 HTTP server using your web browser.
• In Wireshark, filter for TCP traffic (e.g., type 'tcp' in the filter field).

3. Troubleshooting Missing TCP Traffic

If you are not seeing TCP traffic in Wireshark, consider the following:

• Check that your WiFi adapter is in monitor mode and can see both AP and client traffic.
• Ensure that you are using the correct filter in Wireshark. In this scenario, you may need to use a filter like 'tcp.port == 80' if your HTTP server is using port 80.
• Make sure the ESP32-C6 and OpenWRT AP are set to the same channel.

4. Capturing a WPA2 Handshake

If you need to capture a WPA2 handshake, follow these steps:

• Stop the capture in Wireshark.
• In a separate terminal window, use airodump-ng to identify the OpenWRT AP:

airodump-ng wlan0mon -c [channel] --bssid [AP MAC address]

Where '[channel]' is the channel of the AP and '[AP MAC address]' is the MAC address of the OpenWRT AP.

• In a third terminal window, use aireplay-ng to deauthenticate the client:

aireplay-ng --deauth 100 -a [AP MAC address] [client MAC address]

Where '[client MAC address]' is the MAC address of the client connected to the OpenWRT