Search code examples
c#wifipcappcap.netsharppcap

How to capture packages from open wi-fi hotspot using SharpPcap or Pcap.NET?


I can capture packets sent from my computer, but I can't capture packets from other attached devices to wi-fi

Sorry for my bad English


Solution

  • On Wi-Fi, to capture packets not being sent to or from your machine, you have to capture in monitor mode.

    You're probably doing this on Windows, which means that, unfortunately, if you're using WinPcap, you won't be able to capture in monitor mode. Npcap has recently had monitor mode support added. This only works on Windows Vista and later (Windows XP and earlier don't support monitor mode in the OS), and, just as on UN*X with libpcap, requires that the pcap_create(), pcap_set_rfmon(), and pcap_activate() APIs be used - if SharpPcap or Pcap.NET don't support that, and only support the older pcap_open_live() APIs, they can't support monitor mode.

    In monitor mode, on a "protected" network - one using WEP or WPA/WPA2 - the packets you capture will be encrypted (the whole point of WEP and WPA/WPA2 is to make it hard to sniff the network!), and you would have to decrypt the traffic to see anything above the 802.11 layer. This means you'd have to duplicate all the work Wireshark does, which would be A Lot Of Work. Fortunately, if it's truly an open hotspot, it's not a protected network.