Tjyylli

Given my home wifi setup (WPA2) below I can see all traffic from the internal network to the 'Net back (North and South traffic).

I use wlan0 for ssh on the local net. I run suricata as the IDS on the Raspberry Pi and send logs to the Cloud. Life is good.

I am wanting to see and log the East to West connections from an internal wifi client1 to internal wifi client2. My wifi router doesn't provide that.

I got another wlan card thinking that in monitor mode that would do the trick, but I believe I won't be able to decrypt traffic unless joined to the SSID (tried - didn't see anything but management frames in tcpdump).

I also tried promiscuous mode w/wlan1 (confirmed PROMISC in ifconfig) thinking it's joined to the SSID so would therefore do the trick (I'd then just let my IDS/suricata know about the PSK), but I couldn't see traffic apart from unicast/broadcast (none of the other wifi clients).

This is in a small apartment but my wifi clients (recent Androids/Chromebooks) are <5 feet away for testing.

The wlan1 card in the RPi is Panda Wireless PAU05.

Out of more curiosity, am I doomed to fail on the path I said I desire?

I would prefer to do it this way for the academic enrichment or at least learn why I am going to fail. I.E I am aware of BriarIDS and SweetSecurity. I'd also prefer not to spendtoo much money on a high end router and want to continue tinkering.

> +-------------------+ |           

> | |    Cable Modem  | |    

> +----+--------------+ |

>      |

>      |

>      |

>      +<------Anonymous Ethernet bridge:Eth0 (No IP)--+

>      |                  

>      +-----+

>      |     |

>      | Pi  |

>      |     |XXXXXXXXXXX..Wlan0..Wifi Signal..XXXXXX

>      +----++                                    XX

>           |                                    XX

>           +<-----------AEB:--Eth1 (No IP)--+  XX

>           |                                  XX

>       +---+---------------------------+    XXX

>       |  (DMZ port has the ISP IP)    |  XXX

>       |                               | XX

>       |  Wirleless Router -TP Link    |XX

>       |                               |

>       |  (internal ports)             |

>       +-------------------------------+

>          |

>          |

>         +------------------------+

>         | Internal wired pc, etc.|

>         +------------------------+

Monitor mode is what you need, but the ability to decrypt other devices' WPA2-PSK traffic has nothing to do with joining the network. All you need is the PSK (or the passphrase and the SSID, from which you can derive the PSK), and the WPA2 4-way handshake from when the target device joins the network.

You also need your sniffer's wireless card to support all the speed-related capabilities of the wireless hardware in the AP and the target device. Because if, say, the AP and the target device both do 802.11ac, and your sniffer card only does 802.11n and below, then the sniffer won't be able to observe any packets the AP and target device exchange using 802.11ac-specific modulation and coding schemes (MCSes). Besides supported 802.11 speed-related standards (a/b/g/n/ac), and supported MCSes, you must also consider supported spatial streams (1x1, 2x2, 3x3, etc), and supported channel widths (20/40/80/160MHz).