TransWikia.com

Does tcpdump work differently from Omnipeek?

Network Engineering Asked by DJay on September 30, 2021

I have been trying to analyze packets using tcpdump. I am trying to use a wireless card and capture packets through monitor mode, instead of promiscuous mode, since I want to see what kind of traffic can an outsider see, without connecting to the network.

  • My card supports monitor mode, and I always put it in monitor mode before capturing.

Now, here is where my problem starts.

  • I noticed that on some channels, I am only able to see broadcast probe requests, and nothing else.
  • If I try using the same adapter on the same channels on Omnipeek though, it captures many more packets, and even packets going to and from my device, not just broadcast.

So, I was wondering :

  • why Omnipeek was able to capture many more packets in comparison to tcpdump ?
  • It could not be a card related issue because the same card can capture on omnipeek but not on tcpdump.
  • So, why does this happen ?

I have tried looking up various things but I could not find any resources. I will be glad to receive any kind of direction, does not have to be the full solution.

Note: I tried capturing through airmong, and it showed me many more packets as well, but I am trying to capture only through tcpdump, so I am curious.
Also, I am not able to share any output, since the capture is being done on two different machines

One Answer

It looks like both monitor and promiscuous modes of tcpdump should get you a lot of traffic:

https://en.wikipedia.org/wiki/Monitor_mode#:~:text=Monitor%20mode%2C%20or%20RFMON%20(Radio,received%20on%20a%20wireless%20channel.&text=Monitor%20mode%20only%20applies%20to,both%20wired%20and%20wireless%20networks.

https://en.wikipedia.org/wiki/Promiscuous_mode

If you are seeing more traffic with Omnipeek must something from this list:

  1. scanning multiple channels
  2. running in promiscuous mode
  3. providing an OS level driver that can capture the raw packets

Correct answer by user2821413 on September 30, 2021

Add your own answers!

Ask a Question

Get help from others!

© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP