PDA

View Full Version : Missing packets on capture


StevieB
2020-01-09, 08:51
I have installed Kali on an old Sony VAIO (single boot) which has a wireless adapter which supports monitor mode, I also have a Alfa AWUA036NHA adapter.
I am able to go into monitor mode and capture packets but some packets seem to be missing. My first problem is it is intermittent in getting the EAPOL handshakes, I have to keep reconnecting my tablets wifi until I get all 4. Once I get all 4 EAPOL packets in Wireshark I can decode the 802.11 but I know there are packets missing as there are receipts from packets which do not appear.
I have an old MAC mini which works well but is painfully slow and needs a monitor, that shows all packets.
I have take a capture file from my Sony and opened in the Mac and the packets are still missing. I have also taken a capture file from the Mac to the Sony and all the packets are being displayed so it is not a Wireshark problem.

I have also tried capturing with:-
airodump-ng -c9 -w capturefile -d xx:xx:xx:xx:xx:xx wlan0mon (xx:xx:xx:xx:xx:xx being the mac address of the router)
That also has missing packets.

I am new to Kali Linux and have spent a long time searching the internet and getting nowhere.
I suspect it is me being stupid and is a simple setting in Kali.

Any help greatly appreciated.
Mister_X
2020-01-11, 01:29
ACKs are typically sent at a lower rate, so they are received further. It may very well be that the devices are too far away (not in range). If it's not that, you'll have to be more precise on why you say they are missing.
StevieB
2020-01-11, 07:58
I don't think the range is a problem, router, Kali computer and tablet being monitored are all in the same room. Running two captures at the same time, one on Kali and one on a Mac mini, the Mac mini captures all the packets every time whereas Kali sees only a few.
I actually know what commands are being sent from my tablet to a media center (am writing a remote control to combine several android apps into one)

This is the correct capture from the Mac mini

3798

Whereas this is what I am getting on Kali

3799