Requirements:
- Windows 10, or newer
- Wireshark 3.0, or newer (installed with Sshdump component)
- WLAN Pi or SBC (assumption is rpcapd is setup and running)
- SSH Client
Can leverage rpcap
(remote packet capture) protocol supported by Wireshark to capture raw wireless frames from the WLAN NIC used by the WLAN Pi. This can be leveraged to do a packet capture from a WLAN Pi in a remote location.
- Establish SSH session to your WLAN Pi.
- Run this command
sudo /usr/local/sbin/rpcapd -dn
. The rpcap daemon should be running.
sudo iw wlan0 set channel <channel> [NOHT|HT20|HT40+|HT40-|5Mhz|10MHz|80MHz]
sudo iw wlan0 set channel 36 HT40+
sudo iw wlan0 set channel 6
sudo airmon-ng check kill
sudo ip link set wlan0 down
sudo iw dev wlan0 set type monitor
sudo ip link set wlan0 up
sudo iw wlan0 set channel 36
sudo /usr/local/sbin/rpcapd -dn
Example problem during configure:
checking for flex... no
checking for lex... no
configure: error: Neither flex nor lex was found.
Required:
sudo apt install flex bison
Clone via SSH:
git clone [email protected]:the-tcpdump-group/libpcap.git
If you don't have SSH keys setup, clone via HTTPS:
git clone https://github.com/the-tcpdump-group/libpcap.git
Ok, let's configure, make, and install!
cd libpcap
./configure --enable-remote
make
sudo make install
Verify rpcapd
is installed and on your $PATH
:
$ which rpcapd
/usr/local/sbin/rpcapd