Low sniffing rate using Alfa AWUS1900 and rtl8814au

[anatolyvenzekov]

Hi,

I am using rtl8814au driver both in Ubuntu 16.04 and 20.04 reaching monitor mode status and sniffing different wifi channels with no problem. The issue comes with the number of packets I can capture. I am completely sure that the surroundings have a great amount of wifi traffic, but with capture times of a minute I am only able to see dozens of packets.

Do you experience this behavior?? Is there any other configuration a part from the one to put the card in monitor mode?

Thanks in advance!

[n0ss]

Actually I think this depends on the software you are using, the type of attack (active/passive) and the actual attack (what are you trying to capture, how do you configure your command, etc). I don't think your issue is necessarily related to the driver itself. Without further details actually it could be a lot of things

[anatolyvenzekov]

Thanks for the quick response @n0ss .

I am simply sniffing a wifi channel in monitor mode using tcpdump, which below uses pcap library. For that, I simply put card interface in monitor mode with the following commands:
$ sudo ip link set _interface_ down
$ sudo iw dev _interface_ set type monitor
$ sudo ip link set _interface_ up
$ iw dev _interface_ set channel 1

and finally I see the traffic captured with:
tcpdump -i interface -XX

Any idea?

[n0ss]

I suggest you look into hcxdumptools : https://github.com/ZerBea/hcxdumptool
https://github.com/ZerBea/hcxtools

They are the most up to date for targetting Wi-Fi vulns.
What are you currently trying to achieve ?

Also you could read this : https://hashcat.net/forum/thread-9639.html

[anatolyvenzekov]

Simply I just want to sniff as much as WiFi packets as I can, in order to analyze then. I am doing the same with another card of Alfa, AWUS036AC (rtl8812au) and the result in number of packets sniffed is huge compared with AWUS1900.

[Steso871]

i also have low number of AP that my awus 1900 can se. My cheap rtl8812au can se many more