You might note that ssldump hasn’t been updated in a major way for over a decade (but has been ‘patched’ as late as 2013) not a problem, it still works a treat. This tool ‘saved the day’ I can tell you. I’ve had cause to use this tool recently where writing a tcpdump to file and using Wireshark simply hasn’t been possible/permitted. Aside from the obvious advantages, immediacy and efficiency of a CLI tool, ssldump also provides some very useful, nicely parsed data around the SSL/TLS connection itself too. This is a straight copy of my popular Using Wireshark to Decode/Decrypt SSL/TLS Packets post, only using ssldump to decode/decrypt SSL/TLS packets at the CLI instead of Wireshark. This also is dependent on the security mode of the network WPA uses per-device session keys, so you can't see the traffic to other stations because it's encrypted by a key you don't know.Who needs the Wireshark GUI right let’s do this at the command line and be grown up about things.

Modern networks use switches, which inspect the destination addresses of packets and only send it to the port it needs to go to, rather than broadcasting it to all ports (which is what traditional Ethernet, as embodied by shared-medium methods such as 10Base2, and emulated with twisted-pair 'hubs', did).įurther, despite 802.11 series standards using a shared medium (radio waves) promiscuous mode (more properly called 'monitor mode' in the wireless world) may or may not work depending on the wireless chipset and driver, because many devices are implemented in such a way that they don't allow sufficient control to actually cause the physical hardware to pass packets not intended for the station up to the OS.

It doesn't have magical powers to go out onto the network and collect packets destined for other NICs. What you missed is that promiscuous mode only captures traffic that your promiscuous NIC sees.

Wireshark ubuntu install stack exchange