Wireshark · Wireshark-users: Re: [Wireshark-users] How to capture MAC layer packets (Wifi Beacons for instance)

[Guy Harris <guy@xxxxxxxxxxxx>]

On Nov 22, 2009, at 9:10 AM, Pedro Rosas wrote:

> I am currently working on a project at my university, and I need to  
> capture some 802.11 frames.
> For instance, I need to capture the Beacons sent from the APs  
> usually every 100ms.
> When I run Wireshark both on windows 7 and Ubuntu 9.04 I can only  
> capture packets from higher layers (TCP, HTTP, etc.).
> Is it possible to capture the frames from MAC layers of 802.11? For  
> instance, the beacons?

Yes.

Forget Windows 7, but on Ubuntu, if you can put the adapter into  
monitor mode, you should be able to see non-data 802.11 frames.  (If  
your adapter's driver is a mac80211 driver, you might be able to  
capture those on the wmaster interface as well.)