enable monitor mode in wireshark windows ralink

You can open that dialog from the main menu via “Capture” -> “Options” or by pressing CTRL-K. If you run Wireshark, you’ll notice that you have a “Monitor Mode” checkbox in the capture interface dialog for your WiFi cards. Important: you need to make sure “Support raw 802.11 traffic (and monitor mode) for wireless adapters” is checked: If you recently installed Wireshark 3.x (or later) you should automatically have replaced WinPCAP with npcap, unless you didn’t allow the installer to do that. If you want to know more about the differences between the two, check this comparison. Instead, the npcap libraries are used, which replace the discontinued WinPCAP libraries. Since Wireshark 3.0 came out WinPCAP is no longer the default capture library installed. I use either Alfa cards or, in this case, a NetGear A6210, which I bought at a local electronics store.

There’s a matrix available that you can use to check if your card is supported.

Unfortunately, not all WiFi cards support monitor mode on Windows.

Requirement 1 – a WiFi card with monitor mode

The npcap capture libraries (instead of WinPCAP).

A WiFi card that supports monitor mode.

To get the radio layer information, you need at least three things (other than Wireshark, of course): There’s nothing related to the radio layer, so troubleshooting the wireless connectivity is not possible this way. Figure 1 – “Wireless” capture without monitor modeĪs you can see, the capture looks just like a normal Ethernet capture would.

Enable monitor mode in wireshark windows ralink