I use either Alfa cards or, in this case, a NetGear A6210, which I bought at a local electronics store. There’s a matrix available that you can use to check if your card is supported. Unfortunately, not all WiFi cards support monitor mode on Windows. Requirement 1 – a WiFi card with monitor mode The npcap capture libraries (instead of WinPCAP).A WiFi card that supports monitor mode.To get the radio layer information, you need at least three things (other than Wireshark, of course): There’s nothing related to the radio layer, so troubleshooting the wireless connectivity is not possible this way. If you want to avoid any costs associated with drivers for monitor mode packet capture, you are encouraged to use a Linux option.Figure 1 – “Wireless” capture without monitor modeĪs you can see, the capture looks just like a normal Ethernet capture would. If you need to perform wireless traffic analysis with a Windows workstation, Wireshark is an effective tool however, you would have to purchase a driver and hardware combination that supports monitor mode. Unfortunately, at the time of this writing, there are no free software solutions that allow Windows users to capture wireless traffic reliably, and without violating other software license restrictions.

Ensure you have installed the appropriate version (WinPcap 4.0 beta 1) of WinPcap to support the AirPcap. AirPcap is available at After obtaining the AirPcap CD and USB wireless adapter, follow the installation instructions detailed in the AirPcap User s Guide. A combination of a USB IEEE 802.11b/g adapter, supporting driver software, and a client configuration utility, AirPcap provides a simple mechanism to capture wireless traffic in monitor mode on Windows workstations at a reasonable cost. In order to overcome the limitations with most wireless drivers for Windows systems, the engineers at CACE Technologies have introduced a commercial product called AirPcap.

Can windows wireshark use monitor mode