How to Capture the Wireless Packets on MacBook

Introduction

Packets capture and analysis are very important for us to troubleshoot when some unexpected wireless connection problems occur such as the wireless client unable to associate with the SSID, the client not obtain an IP address, or intermittent wireless connection, etc. This document will discuss how to capture the wireless packets by using the MacBook and WireShark.

Prerequisites

1. WireShark software

WireShark is available at www.wireshark.org. It’s a free and powerful sniffing and analyzing software.

2. Modern MacBook.

Modern MacBook is recommended because 1) its wireless NIC driver supports monitor mode. 2) It has 3x3 radios that can sniff 3 NSS traffic. Some wireless NIC with special driver can also work at monitor mode and capture wireless packets.

Note: If the wireless NIC doesn’t support monitor mode, the WireShark cannot capture full 802.11 frames (including 802.11 management, control and data frame) and the WireShark will transfer the 802.11 frame to the fake 802.3 frame which doesn’t have the head info of the 802.11 frame.

Typical Wireless Packet Capturing Topology

Assuming the wireless client has Wi-Fi connection problem, we can use the MacBook running with WireShark as the monitoring device near the AP or the wireless client to capture the interactive wireless packets between the Wireless Client and the AP.

Procedures

1. Download and install the macOS version WireShark on your MacBook
2. Open WireShark
3. Click on the gear icon at the top

4. Ensure the monitor mode is enabled for the Wi-Fi: en0 interface as shown in the picture below

5. Click close and restart the WireShark.
6. Connect the MacBook to the SSID first to make sure the NIC is sniffing the packets from the channel that the radio is using.

Why is this step necessary? According to the test, after the MacBook connects or just tries to connect to a specific SSID, the WireShark can then sniff the wireless packets in the same channel of this SSID. And we haven’t found other efficient ways to steer the WireShark to sniff packets on a specific channel.

7. Start a capture on Wi-Fi en0. You should see beacon frames interspersed with data frames as shown in the picture below. Please start capturing when you begin to elaborate the Wi-Fi issue and stop capturing when you finish the elaboration.