Second of all, your network is probably a 'protected' network, using WEP or some version of WPA, meaning all the packets are encrypted. This may persist after the capture stops closing your machine and opening it up again might fix this. NOTE: the adapter on machines that require the use of Wireless Diagnostics may disassociate from your network while in monitor mode, in which case your machine will no longer have Internet access. Select 'Sniffer' from the 'Window' menu (don't bother with the 'Introduction' dialog that Wireless Diagnostics pops up).

Open Wireless Diagnostics by Option+click on the Wi-Fi element in the menu bar and selecting 'Open Wireless Diagnostics.'.

With newer Macs, Apple decided to make life difficult, for some unknown reason, so, currently, the only way to capture in monitor mode is to: With older Macs, the monitor mode checkbox should Just Work. The virtual machine's network interface is a pretend Ethernet interface, which could run in promiscuous mode, but 1) not monitor mode, as it's not a pretend Wi-Fi network adapter and 2) promiscuous mode will capture only on the 'network' it's on, which is a virtual network passing traffic between the host and the guest, so, at most, it might be able to capture traffic between virtual machines running at the same time or between other virtual machines and the host. Your machine may be able to do it - but only if you're capturing on the Mac itself. I'm guessing that Kali Linux includes airmon-ng, so look at the part of the instructions that mention airmon-ng. See the section of the Wireshark Wiki that discusses capturing in monitor mode on Linux. Your youngest son's machine should be able to do that.

:-)įirst of all, if you want to capture other machines' traffic on a Wi-Fi network, you would need to capture in monitor mode. I take no responsibility for any consequences of this prank. I will let an advice columnist advise you on the wisdom of this plan.

Wireshark not capturing packets