2

We are currently working on a project, where we want to see the packets sent over WiFi. We are using an RPi zero w as a sniffer, and we have managed to use ioctl calls to get ssid and other informations, but only for the network we are currently connected to. How would we manage to scan for wifi packets from all incoming networks? And how would we go about getting the signal strength of those packets? If you have any links or suggestions to point us in the right direction, those would be very much appreciated.

We are using an RPi zero w with Raspbian Lite (Buster).

Improve this question
2
  • To sniff packets on a WPA encrypted network you must be logged onto that network before the devices you want to sniff are. Otherwise, you miss the first exchange and further traffic will not make it onto the interface. Note that there's already a well established suite of sniffing tools available for Raspbian and other GNU/linux distros -- see tcpdump and wireshark. The C library used is library used is libpcap: tcpdump.org
    – goldilocks ♦
    Commented Apr 1, 2020 at 13:23
  • 1
    Have you looked at installing Kali as that should include all the tools you need to continue your nefarious activities.
    – Dougie
    Commented Apr 1, 2020 at 14:41

2 Answers 2

Reset to default
5

Sniffing other WiFi networks you are not associated must be supported by the WiFi chip, called monitor mode. If you look at the chip configuration on the RasPi with:

rpi ~$ iw list
Wiphy phy0
--- snip ---
    Supported interface modes:
             * IBSS
             * managed
             * AP
             * P2P-client
             * P2P-GO
             * P2P-device
--- snap ---

There is no monitor mode available, so you are out of luck with sniffing WiFi networks with a Raspberry Pi. There is a project nexmon on github that patches the WiFi firmware to make the monitor mode available. Seems not to be an easy task but you may have a look at it.

You may consider to purchase an additional USB/WiFi dongle that supports monitor mode.

Improve this answer
5
  • You can do it with a cheap USB dongle.
    – goldilocks ♦
    Commented Apr 1, 2020 at 13:27
  • @goldilocks Yes, of course, but you must be sure that such a dongle supports monitor mode. Far not all do it. I have updated the answer.
    – Ingo
    Commented Apr 1, 2020 at 13:44
  • I think most probably do; that the one on the Pi doesn't seems an intentional decision for whatever reason. But yes you should of course check, and check it is reliable on linux generally. A problem with that is it is not unusual for manufacturers to upgrade/replace the chip used in "exactly the same" model with a different one, and it's the chip that's the issue; finding out which one it is if you don't actually have the dongle (if you do, the USB id from lsusb identifies it) is not necessarily as easy as it should be .
    – goldilocks ♦
    Commented Apr 1, 2020 at 13:59
  • "Monitor Mode"... is that the same as "Promiscuous Mode"? This didn't completely answer the question.
    – Seamus
    Commented Apr 2, 2020 at 1:15
  • 1
    @Seamus From the behavior it is comparable. Promiscuous Mode is needed to sniff wired connections, Monitor Mode is needed to sniff wireless connections. But from the technical view they are completely different. On a wire the interface firmware suppresses all packages not addressed to the device (mac address). Promiscuous Mode just disable the filter so you can see all packages on the wire - easy and no problem. On wireless there is not a simple addressing with mac addresses (comes only to play when associated), so you need hardware support to sniff this.
    – Ingo
    Commented Apr 2, 2020 at 9:28
2

As @Ingo has pointed out, RPi Zero W is not your best choice for a radio. As a suggestion on how to proceed, perhaps read this tutorial on sniffing wireless packets, and then visit the WireShark website. As far as the radio itself, you might try looking for a USB dongle that uses the Atheros chipset. Here's a resource that may help finding a manufacturer.

But perhaps this is more than you wanted? If all you want is signal strength of the received packets, this article has some ideas.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.