View Traffic In Real Time

[AnubisTheJackle]

Ok, I'm sure there is a way to do this. I just can't figure it out.

What I want to do is view the capture file that I'm capturing using airodump-ng in real time. This is my own personal WPA-PSK TKIP connection. I have 2 laptops running on it at any given time, I'd like to be able to see what the OTHER laptop is doing in real time.

Is there any way to do this? I've attempted to use Wireshark, but it won't even pick up any wireless interfaces so that's a no-go. Currently I can view the data after the fact by running airdecap-ng and then loading the decapped file into Wireshark, but this isn't real time.

[leroux-cifer]

Try using another wireless card/adapter. That may solve your problem. Otherwise, what you are trying to do is exactly what Wireshark with some ARP poisoning will do. Look into ARP poisoning here: http://www.watchguard.com/infocenter/editorial/135324.asp

[Goatboy]

I'd use Wireshark in promiscuous mode, if your card supports it. If not, stick with ARP poisoning.

[leroux-cifer]

If I'm not mistaken, Wireshark usually defaults to promiscuous mode when capturing packets.

[AnubisTheJackle]

Thank you for the replies. I've not yet figured out how to get my interfaces working with Wireshark, I'm not sure if it's my card/USB adapter, or if it's my stupidity when I got wireshark. I'm still rather new to Linux, and actually managed to make it so Ubuntu won't load for me today, so I'm going to have to reinstall that partition. Oh well, every time I mess up, I learn what not to do next time.

[insomaniacal]

I've done this with wireshark, but just a cautionary note, It'll look like mumbo-jumbo for the most part unless you filter out your results.

If you haven't already re-installed Linux however, I'd recommend trying to fix it rather than reinstall it. Doing that sort of thing really helps you learn, especially if you're new to a concept.