Purpose
From version 5.0, the FortiAP has the feature to sniff wireless traffic using its radio. This feature is not present in version 4.0 MR3. This article provides a workaround to this and explains how to sniff traffic in the air using wireshark.
Scope
FortiAP running 4.0 MR3.
Expectations, Requirements
In some cases, to troubleshoot network issue, a wireless trace is required.
It is possible to sniff wireless traffic using a Linux machine with a Wireless NIC card.
Wireshark must be installed on the Linux PC.
On Ubuntu distribution, run the following command:
sudo apt-get install wireshark
The NIC card can be set to monitor mode using the airmon-ng
Here are the commands and options to use airmon-ng:
airmon-ng <start|stop> <interface> [channel]
<start|stop> indicates if you wish to start or stop the interface. (Mandatory)
<interface> specifies the interface. (Mandatory)
[channel] optionally set the card to a specific channel.
To see the current status of the wireless NIC card, the command iwconfig can be used
root@root:~# iwconfig
lo no wireless extensions.
eth0 no wireless extensions.
wlan0 IEEE 802.11bgn ESSID:"SSID12"
Mode:Managed Frequency:2.412 GHz Access Point: Not-Associated
Tx-Power=20 dBm
Retry long limit:7 RTS thr=2347 B Fragment thr:off
Encryption key:off
Power Management:off
At this stage the wireless NIC card is not in monitor mode.
To start Monitor mode on the Wireless NIC card:
root@root:~# airmon-ng start wlan0
Interface Chipset Driver
wlan0 Unknown rtl8192ce - [phy0]
(monitor mode enabled on mon0)
Monitor mode has now been enabled on wlan0 on mon0
To verify that mon0 is in monitor mode, use iwconfig
root@root:~# iwconfig
lo no wireless extensions.
eth0 no wireless extensions.
wlan0 IEEE 802.11bgn ESSID:"SSID12"
Mode:Managed Frequency:2.412 GHz Access Point: Not-Associated
Tx-Power=20 dBm
Retry long limit:7 RTS thr=2347 B Fragment thr:off
Encryption key:off
Power Management:off
mon0 IEEE 802.11bgn Mode:Monitor Tx-Power=20 dBm
Retry long limit:7 RTS thr=2347 B Fragment thr:off
Power Management:on
Mode is set to Monitor
Wireshark can now be started. Sniffing on interface mon0 will capture wireless traffic.
root@root:~# wireshark &
To stop monitoring mode on the wireless NIC card, the following command can be used:
root@root:~# airmon-ng stop wlan0
It can be verified using iwconfig command:
root@root:~# iwconfig
lo no wireless extensions.
eth0 no wireless extensions.
wlan0 IEEE 802.11bgn ESSID:"SSID12"
Mode:Managed Frequency:2.412 GHz Access Point: Not-Associated
Tx-Power=20 dBm
Retry long limit:7 RTS thr=2347 B Fragment thr:off
Encryption key:off
Power Management:off
