# 2️⃣ Wireshark (Win)

{% hint style="warning" %}
Even if you already have Wireshark installed!\
We need to reinstall it with a critical (non-default) checkbox checked
{% endhint %}

### Step 1 - Download & Install

{% embed url="<https://www.wireshark.org/download.html>" %}
Click link, download and install!
{% endembed %}

From the **'Choose Components'** screen\
Expand **Tools**\
Select **'Ssh dump & Ciscodump'** checkbox

![Select 'Ssh dump & Ciscodump' checkbox](https://3322710523-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDnAtqunpTqpLLEpj02Uf%2Fuploads%2Fgit-blob-e9e2ac079e9964dcd422082184e863a5bb3ff5c4%2FScreen%20Shot%202022-02-13%20at%205.49.21%20AM.png?alt=media)

{% hint style="info" %}
This option enables remote packet capture via SSH

All other options can (& should) be left as default
{% endhint %}

### Step 2 - wlan-extcap

{% file src="<https://3322710523-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDnAtqunpTqpLLEpj02Uf%2Fuploads%2Fgit-blob-f32351efa4910837374972e78030fda0fe38111e%2Fwlandump.zip?alt=media>" %}
Download this file
{% endfile %}

1. Download wlandump.zip and extract the contents onto your desktop
2. Move both wlandump files into folder\
   `C:\Program Files\Wireshark\extcap`

{% hint style="info" %}
For wlan-extcap source and additional information go to GitHub: <https://github.com/adriangranados/wlan-extcap>
{% endhint %}

### Step 3 - Wireshark <a href="#step-4-wireshark" id="step-4-wireshark"></a>

1. Open Wireshark
2. You should see 'Wi-Fi remote capture' in the list of available interfaces

![wlan-extcap installation was successful](https://3322710523-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDnAtqunpTqpLLEpj02Uf%2Fuploads%2Fgit-blob-0a99b3f1bf07da6bac10e71cc9b2a565ba1c10cf%2Fimage%20\(6\).png?alt=media)

### Step 4 - Remote Wi-Fi Capture

The `wifidump` capture interface allows you to perform remote Wi-Fi packet captures on a specified channel and channel width using a Linux device with a compatible Wi-Fi adapter (one that can be put into monitor mode).

Click the gear icon next to "Wi-Fi remote capture" to display the interface options, then choose the interface name, channel, and channel width you want to capture on​

![target wlan0 as the interface for performing the capture](https://3322710523-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDnAtqunpTqpLLEpj02Uf%2Fuploads%2Fgit-blob-768c9a4b73d2058496fcf5018dcb19c8eeaad3f5%2Fimage%20\(21\).png?alt=media)

{% hint style="info" %}
All 802.11 channels are listed, however, the Wi-Fi adapter on the WLAN Pi device may support only a subset of them. If you choose a channel that is not supported by the Wi-Fi adapter or a channel width that doesn't apply to the selected channel, the capture will fail.
{% endhint %}

Go to the *Server* tab and enter the remote SSH server address\
With an OTG connection to the WLAN Pi `169.254.42.1`

![OTG connection IP address, port can remain at default value of 22](https://files.gitbook.com/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxzXEUPabNPWCoRaNWam2%2Fuploads%2FP4hOjxsjXRNoXnRF5LIu%2Fimage.png?alt=media\&token=41bf04f2-0ae0-42d7-a9da-cff7b5c888eb)

Go to the *Authentication* tab and enter the username and password​

![Enter the credentials you have configured for your WLAN Pi](https://files.gitbook.com/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxzXEUPabNPWCoRaNWam2%2Fuploads%2Fe8MCEolR0iReGBcZY0Xr%2Fimage.png?alt=media\&token=394ebf85-7e24-43f9-94d6-ece42a1876b3)

{% hint style="info" %}
The password is not saved, this means every time you stop and start a new capture you will have to re-enter your password.

This hassle can be avoided by configuring passwordless SSH authentication to the WLAN Pi (we are not going to cover this here and now)
{% endhint %}

Click the **Start** button to begin capturing frames​

![...And you are away](https://files.gitbook.com/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxzXEUPabNPWCoRaNWam2%2Fuploads%2F466fm2VC8kRU1Bc2JrOu%2Fimage.png?alt=media\&token=cc9ae16b-b1dd-4a95-947b-b3c84656c1a0)