# tcpdump and wireless when associated(wifi)

## truc

Hello,

I'm trying to tcpdump *all* the traffic on the SSID I'm connected to.

I've tried using the -I option of tcpdump, but it disconnects me from the AP.

I'm sure I am missing something, but I just don't know what. Most of the doc I find is about sniffing all traffic and not just the one for your SSID (and the traffic can be encrypted!).

This is my wireless interface:

```
02:00.0 Network controller: Atheros Communications Inc. AR9285 Wireless Network Adapter (PCI-Express) (rev 01)
```

Any idea?

TIA

----------

## chiefbag

I don't see any such "I" option under my version

```
tcpdump --version                                                    

tcpdump version 3.9.8

libpcap version 1.1.1

Usage: tcpdump [-aAdDeflLnNOpqRStuUvxX] [-c count] [ -C file_size ]

                [ -E algo:secret ] [ -F file ] [ -i interface ] [ -M secret ]

                [ -r file ] [ -s snaplen ] [ -T type ] [ -w file ]

                [ -W filecount ] [ -y datalinktype ] [ -Z user ]

                [ expression ]
```

Are you trying to specify the interface?, that would go like the following 

```
tcpdump -i eth0
```

OR

```
tcpdump -i wlan0
```

----------

## truc

```
tcpdump -h

tcpdump version 4.2.1

libpcap version 1.2.1

Usage: tcpdump [-aAbdDefhHIJKlLnNOpqRStuUvxX] [ -B size ] [ -c count ]

                [ -C file_size ] [ -E algo:secret ] [ -F file ] [ -G seconds ]

                [ -i interface ] [ -j tstamptype ] [ -M secret ]

                [ -r file ] [ -s snaplen ] [ -T type ] [ -w file ]

                [ -W filecount ] [ -y datalinktype ] [ -z command ]

                [ -Z user ] [ expression ]

```

It's not listed in the short usage but in the manual

 *Quote:*   

> -I     Put the interface in "monitor mode"; this is supported only on IEEE 802.11 Wi-Fi interfaces, and supported only on some operating systems.

 

As I understand, you need to set the interface in monitor mode to be able to see *all* trames (not just yours), my problem is that it disconnects me from the AP

----------

## chiefbag

You won't be able to use tcpdump in such a manner I don't think.

You want to be capturing at a packet level.

Take a look at the following Wireshark link which give a good insight into the process.

http://wiki.wireshark.org/CaptureSetup/WLAN

----------

