How to capture 802.11 packets with wireshark

It is emphasized that my system is win10, and a linux virtual machine is established on this basis.

First of all, we need to edit the environment in linux, because we cannot capture 802.11 packets in win. The tool I use is wireshark.

sudo apt-get install wireshark

sudo apt-get install wireshark-gtk

If during installation

I can only say that the virtual machine is reinstalled. This is a problem. I am using ubuntu 16.0.2 (64) now. The virtual machines are relatively new now, and there will be basically no problems after reinstalling.

After that, start to check whether there is a network card in the virtual machine. To capture 802.11 frames, you need to open the wireless network card.

Enter: iwconfig

If this happens, it means that there is no network card installed inside the virtual machine, and it cannot connect to the LAN without a network card. This may be very strange. Obviously, the virtual machine can access the Internet, and the upper right corner shows why there is no network card, because it is now connected to the host's network.

In fact, you may see such a pop-up window when the virtual machine is just turned on, as follows:

The above picture can fully explain that, no matter it is a network card or a mobile U disk, only one operating system can be connected at the same time.

When connecting it to the host, let's first check if the virtual machine service is enabled, and return to the host: My Computer - Right Click - Manage - Services, find the following items and enable them

First make sure that the computer host has installed a wireless network card, if not, install one with the driver software.

Then go back to linux and select: virtual machine-removable device-Ralink 802.11n USBWireless LAN Card-connection, at this time, the network card is transferred to the virtual machine, and it can be disconnected when not in use, and it will be automatically transferred back to the host.

Entering the command

iwconfig

result:

lo       no wireless extensions.

wlx64fb816ae233  IEEE 802.11  ESSID:off/any 
          Mode:Managed  Access Point: Not-Associated   Tx-Power=0 dBm  
          Retry short limit:7   RTS thr:off   Fragment thr:off
          Power Management:on
         
ens33     no wireless extensions.

Among them  is the name of the network card (it doesn't matter what it is called, it may be another name)

Execute the following command:

sudo iw dev wlx64fb816ae233  interface add mon0 type monitor

sudo ifconfig mon0 up

After sudo wireshark-gtk
enter the wireshark interface, select the mon0 interface to capture packets

Thanks!