TABLE OF CONTENTS Traditional network sniffing on an Ethernet network is fairly easy to set up. In a shared environment, an analysis workstation running Wireshark starts a new packet capture, which configures the card in promiscuous mode and waits until the desired amount of traffic has been captured. In a switched environment, you need to configure a span port that mirrors the traffic sent to other stations, before initiating the packet capture.
In both of these cases, it is easy to initiate a packet capture and start collecting traffic for analysis. When you switch to wireless analysis, however, the process of traffic sniffing becomes more complicated and requires additional decisions up front to best support the analysis you want to perform.
Where a wired network offers a single medium mechanism for packet capture (i.e., the wire), wireless networks can operate on multiple wireless channels using different frequencies in the same location. A table of wireless channel numbers and the corresponding frequencies is listed in Table 6.1. Even if two wireless users are sitting side-by-side, their computers may be operating on different wireless channels.
| Frequency Channel Number | Frequency | Channel Number |
|---|---|---|
| 2.412 GHz 1 | 2.484 GHz | 14 |
| 2.417 GHz 2 | 5.180 GHz | 36 |
| 2.422 GHz 3 | 5.200 GHz | 40 |
| 2.427 GHz 4 | 5.220 GHz | 44 |
| 2.432 GHz 5 | 5.240 GHz | 48 |
| 2.437 GHz 6 | 5.260 GHz | 52 |
| 2.442 GHz 7 | 5.280 GHz | 56 |
