Reconnaissance and Traffic Capture/Analysis with Aircrack-ng, Kismet and Wireshark
This domain tests a repeatable workflow: survey the airwaves, lock onto a target, force or wait for the frames that matter, then prove in Wireshark that what you captured is actually usable.
Survey before you target
airmon-ng check kill stops NetworkManager and wpa_supplicant from resetting the interface; airmon-ng start wlan0 creates a monitor interface such as wlan0mon. airodump-ng wlan0mon hops channels and prints BSSID, PWR, Beacons, #Data, CH, MB, ENC, CIPHER, AUTH and ESSID. The #Data column is the tell: an AP with associated clients produces data frames, and an AP with none can never yield a 4-way handshake no matter how long you listen.
Targeted capture
airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w wpa wlan0mon locks the channel - hopping drops the frames you need - and writes pcap files. Force the handshake with aireplay-ng -0 5 -a <AP> -c <client> wlan0mon; airodump-ng prints "WPA handshake: " in its header once it holds M1+M2 or M2+M3.
Kismet and Wireshark
Kismet is a passive, multi-source detector that logs SQLite, pcapng and netxml; run it as kismet -c wlan0mon. In Wireshark the high-value filters are eapol, wlan_rsna_eapol.keydes.msgnr==2, wlan.fc.type_subtype==0x08 (beacon) and wlan.fc.type==0 && wlan.fc.subtype==12 (deauth). airdecap-ng decrypts a capture once the key is known.
Worked example
Airodump-ng shows a WPA2/CCMP/PSK target with #Data stuck near zero and an empty station list. Reasoning: with no associated station there is nobody to deauthenticate, so a handshake will never appear. The pivot is a PMKID capture (hcxdumptool on the same channel) or a different, populated target.
Traps
- Leaving channel hopping enabled during a targeted capture.
- Omitting
-b <BSSID>in aircrack-ng when the capture contains several APs. - Typing the ESSID differently from the beacon - the PMK is SSID-bound and the mismatch silently fails.
- Trusting a green "handshake" marker without confirming both nonces and a MIC in Wireshark.