Wireless networking sniffing

Apologies that this isn't to do with linux but this is the only active
group I could find on networking. Also the 'sniffing' I'm asking about
is on my own network for ethical reasons.

I downloaded an app (pirni) onto my iPad tablet which claims to sniff
packets on a wireless network. I wanted to see it working by sniffing
packets between my desktop PC and router. Initially I thought I would
have to also have my tablet running as a MITM between my PC and a 3G
network. This didn't work, the app kept complaining that I wasn't
connected to a wireless LAN, which confused me.

Eventually I looked at a howto guide which simply said I needed to
connect to a wireless network. I also had to provide an IP address to
spoof which had to be the router's IP address. I chose to monitor TCP
packets sent to port 80. I didn't see how it would work but I visited
a web page from my PC and saw my http request flash up on the screen
of the tablet.

I'm confused about how this would work. The wireless network I used is
WPA2 encrypted. Surely the packets between my PC and the router are
encrypted and even a device connected to the same network shouldn't be
able to intercept packets between other devices?

On Wed, 21 Sep 2011 15:07:40 -0700 (PDT)
(E-Mail Removed) wrote:

> I'm confused about how this would work. The wireless network I used is
> WPA2 encrypted. Surely the packets between my PC and the router are
> encrypted and even a device connected to the same network shouldn't be
> able to intercept packets between other devices?

The device being connected to the wireless network, it knows the
encryption keys, if a PSK scheme is used. So all the device has to do
is eavesdropping on what's going over the air, completely passive and
decrypt it with the key it knows, due to connecting to the network.
There's really nothing special about it.

Using a regular Linux system, all you've to do is setting your W-LAN
interface to so called "promiscious mode" and dump all the traffic it
sees using tcpdump, pcap or Wireshark.

Per device keys are only used in so called 802.1X/EAP authentication
mode.


Wolfgang