In this article, we will discuss troubleshooting common issues with TCPDump and Wireshark when no packets are displayed in monitor mode. Monitor mode is a powerful feature that allows capturing all traffic on a network interface. However, it can sometimes be challenging to get it working correctly.
Prerequisites
Before we dive into the troubleshooting steps, let's ensure that the following prerequisites are met:
- You have the necessary permissions to stop network services and monitor network traffic.
- Your system meets the minimum requirements for TCPDump and Wireshark.
- You have TCPDump and Wireshark installed on your system.
Stopping Network Services
The first step in troubleshooting no packets displayed in monitor mode is to stop any network services that might interfere with the capture process. In the provided question, the user has already stopped NetworkManager, avahi-daemon, and disabled NetworkManager. Let's verify the commands:
sudo systemctl stop NetworkManager
sudo systemctl disable NetworkManager
sudo systemctl stop avahi-daemon
These commands will stop and disable NetworkManager, which manages network connections, and avahi-daemon, which is responsible for multicast DNS name resolution. Disabling NetworkManager will prevent it from automatically starting up and interfering with the capture process.
Verifying TCPDump and Wireshark
Once network services are stopped, let's verify that TCPDump and Wireshark are installed and functioning correctly. To check the installation of TCPDump, run:
tcpdump --versionThis command should display the version number of TCPDump installed on your system.
To check the installation of Wireshark, open a terminal and run:
wiresharkThis command should launch the Wireshark graphical user interface (GUI). If Wireshark is not installed, you will be prompted to download and install it.
Starting a Capture
With TCPDump and Wireshark verified, let's start a capture in monitor mode. Open a terminal and run:
sudo tcpdump -i any -s 0 -w capture.pcapThis command will start a capture on any interface in promiscuous mode, with a snapshot length of 0 bytes (capturing the entire packet), and save the capture to a file named capture.pcap.
Verifying the Capture
Once the capture is complete, open Wireshark and load the capture file:
wireshark capture.pcapIf no packets are displayed, there are a few things to check:
Check the Interface
Make sure that the capture is being performed on the correct interface. In the terminal, run:
tcpdump -DThis command will display a list of available interfaces. Verify that the interface used for the capture matches the one specified in the TCPDump command.
Check the Capture File
Check the capture file size to ensure that it was created correctly. Run:
ls -lh capture.pcapThis command should display the file size in human-readable format. A capture file with no packets should be empty.
Check the Capture Filter
If the capture file is not empty, check the capture filter. TCPDump and Wireshark use different capture filters by default. To use Wireshark's capture filter in TCPDump, add the filter to the command:
sudo tcpdump -i any -s 0 -w capture.pcap "not icmp and not arp and not tcp and not udp"This command will capture all traffic except ICMP, ARP, TCP, and UDP.
Check the Capture Speed
If the capture speed is too high, packets may be dropped. Use the -c option to limit the number of packets captured:
sudo tcpdump -i any -s 0 -c 1000 -w capture.pcapThis command will capture the first 1000 packets.
References