★ THE BLOG ★ Ramblings on WiFi & stuff.

Options for Wireless Packet Capture in Windows

UPDATED: 05/28/2019

HOLD THE PRESSES!!! So, as of Wireshark 3.0, you can do RF Monitor mode captures in Windows using inexpensive NICs. Specifically, the Netgear A6210. Here’s write up on how to set this up, but nothing special is required other than Wireshark 3.0, or newer, and a supported NIC (Netgear A6210).

So, of course, this comes with some caveats. The main one is that this does not support channel information. So, while you CAN set the channel you want to capture on, there will be no data in the capture confirming you are indeed on that channel.

WiFiXax has a blog post on howe to do it.

You can go ahead and read the rest of this post, but at this point, why would you? ¯\_(ツ)_/¯

In Windows, you cannot effectively analyze wireless frames, because you are unable to put the wireless NIC in "RF Monitor Mode" - that is the mode in which the wireless NIC can see ALL 802.11 frames in the air, not just ones intended for itself.

Historically, it's been an expensive proposition. There are some great tools out there like OmniPeek (which I use), the gold standard for Windows packet analysis. And for years, AirPcap Nx was the main NIC folks used for pcap'ing WLANs with Wireshark. Unfortunately, both options are pricey. And the AirPcap NX is no longer manufactured. You’d be lucky to find a used one on eBay. Linux and MacOS have been the only ways to cheaply get access to RF Monitor mode without spendy software and hardware, like Omnipeek and the AirPcap Nx.

But, not everyone uses Linux, or Mac OS. Fortunately, and fairly recently, there are more and more ways to get RF Monitor mode in Windows. Here are some relatively inexpensive options (NOT an exhaustive list) to perform an RF Monitor Mode wireless packet capture in Windows using relatively inexpensive hardware.

OR, you could just get a Mac and do it natively. 😉

Lastly, if you have access to an Ekahau Sidekick, and you have an Ekahau Connect account, you can use the Sidekick to perform offline packet captures, and you can even have each NIC capture on a difference channel! Cool!

Here are some additional resources for wireless picture capture in Windows from @Ron_van_Kleunen‬:

* If anyone has additional relatively inexpensive options for this list please DM me @HeyEddie

"relatively inexpensive"


I don't know. Less than a grand? Less than $500? Please don't get all pedantic on me. 😉

REVIEW: AirTool 1.0


I've been beta testing a new app called AirTool from developer Adrian Granados for a few days. It finally went live today, so here is an overview of the app .

What does it does:

  • Select specific channels to perform a pcap on in 2.4/5GHz.
  • Select channel width
  • Capture on ALL 2.4/5GHz channels (hops through channels during pcap.)
  • Open pcap in Wireshark automatically upon stopping capture.
  • Visual indicator in task bar of channel/width

Best of all the app is FREE! 


Here is a link to make a donation via paypal. Let's help keep independent developers working!

802.11ac Analysis Webinar from CWNP

Presented by Tom Carpenter.

In this webinar, CWNP offers suggestions and information on the hardware and software available in the fall of 2014 to perform analysis of 802.11ac WLANs. Hardware demonstrated includes the Linksys WRT1900ac, the Cisco WAP371, the Edimax EW-7822UAC, the NETGEAR A6200 and the Wi-Spy DBx. Software includes Omnipeek, Commview for WiFi, Airmagnet, and Wireshark.

How to Perform a PCAP with Aruba Instant AP

Estimated reading time: 1 minute, 7 seconds. Contains 224 words

So, this guy at WLAN Pros Conference says, “I wish I could do a packet capture on Aruba Instant”. This other guy says, “I don’t think they can do that”. I say, “Oh, yes, they can.” The other guy say, “Really? Are you sure?” And I say, “Absolutely. I think. Hold on.”

So, I proceed to login to my knowledge base, download, and then e-mail the first guy this PDF that PROVES - beyond a shadow of a doubt - that I am nobody’s fool!

I was wrong.

Wrong, wrong, wrong, wrong, wrong…

Or, so I thought! I sent him the wrong document. Turns out you CAN do pcap on Aruba Instant I just didn’t know that I didn’t know what I was talking about.

Anyways. here’s how it’s done. I stole it from Aruba AirHeads.

- - - - - - - - - - - - - - - - -

Make sure you’ve upgraded to the latest version of Instant OS so you can use the pcap command to do the wireless packet capture on the IAP.

Run the Aruba version of Wireshark on the PC, on the capture interface, select ARUBA udp-port=5555

SSH into IAP

Use “pcap start <base bssid> <ip address of PC with Aruba version of Wireshark installed> <port> 0 1518”

Use “show pcap” to check the active pcap session

Use “pcap stop <base bssid> <pcap-id> to stop the capture