Monitor Specific WiFi Traffic with Wireshark or Python?

Question

I'm looking to capture specific WiFi traffic data on a network in a household.

What I would like to collect is the volume of data, the timings and the devices involved. This is for a study of mine, looking to monitor WiFi traffic in terms of collecting volume of data (maybe packets per second or packet lengths), the times and the devices (so if the device is a laptop, mobile phone or desktop PC using the WiFi).

However, for ethical reasons, I want to filter out certain details that WireShark would typically collect (for example, I don't want to capture DNS information or any detailed information about what a user is doing).

Does WireShark allow for configuration of what it captures? Or, if not, would it be possible to run a Python script which sort of 'cleans up' the data captured by WireShark so I am only collecting what I want?

Alternatively, I've looked into running a Python script to collect the network traffic (using scapy) but not sure this allows me to collect WiFi traffic or the devices involved (which is ideally what I am looking for).

Does anybody have any suggestions about an approach, or can recommend out of my options about which is most sensible/feasible/easiest?

Thank you

grochmal grochmal · Accepted Answer · 2016-05-22T21:50:56

Wireshark allows you to filter before outputting to the current capture Capture Options -> Capture Filter. The filter can include a plethora of options and will ensure that only the packets that match are saved.

On a small note i'd suggest to look at tshark. Wireshark comes with tshark (although it is bundled as separate packages on some distros/OSes). tshark is pretty much a command line wireshark.

By default tshark outputs to STDOUT in a format that tries to by human readable (not the PCAP format).

If all you need is the number of packets of a certain kind you can just filter with tshark and count on the fly, and never save the packets themselves. For example:

counter=1;
tshark tcp src port 80 2>/dev/null |
while read x; do
    counter=$((counter + 1));
    echo $counter;
done

Will output the number of TCP packets that originate from port 80 from the moment the script starts until you interrupt it.

(tshark uses the same filter syntax as wireshark)

Monitor Specific WiFi Traffic with Wireshark or Python?

1 Answers