Should the Wifi Coconut capture unencrypted data packets?

[davidb62]

I just received my Wifi coconut today.  Setup was very easy and it was up and running on my Mac in no time

However I am not getting the results I expected. 

I created a test open Wifi network on my router only using 2.4Ghz and connected to it with my device.  I set the Coconut to record to pcap.   I visited some HTTP websites, generated some TLS traffic but I can't find the data packets in my capture.   I don't really find much of interest apart from mostly 802.11 packets and a few MDNS packets

My Coconut, router and device are in close proximity.

Am I missing something or is the expected behaviour? 

Thanks!

 

[DramaKing]

Sounds like the Coconut is set to monitor mode. I don't know how the software works yet, but it should save frames containing data packets. The payloads, however, would be encrypted if you're not using Open authentication.

[davidb62]

On 8/30/2022 at 3:22 PM, DramaKing said:

Sounds like the Coconut is set to monitor mode. I don't know how the software works yet, but it should save frames containing data packets. The payloads, however, would be encrypted if you're not using Open authentication.

I was testing with a nearby open wifi access point.  No encryption, but I did not find many data packets apart from mostly MDNS and other broadcast / multicast data packets.   

[DramaKing]

There are no arguments to change what types of frames are saved, so the executable may need to be updated to have that functionality. 

[davidb62]

I thought the idea was that it would capture everything on all 14 2.4Ghz channels including unencrypted wifi 😞