Skip to content


Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?


Failed to load latest commit information.
Latest commit message
Commit time
July 24, 2017 19:28
June 14, 2017 15:01
June 14, 2017 12:29
June 14, 2017 12:29
October 20, 2021 17:32
June 14, 2017 12:33
June 14, 2017 12:33


Create and send .pcap files using ESP8266/ESP32 and Arduino.

Sniffing WiFi with ESP32 & ESP8266 in Wireshark

Please Note

This is a proof of concept! The included examples are only for ESP8266 and ESP32, but the library can be used for other Arduinos as well. The packet output in the examples is unfiltered and maybe malformed, errors can occur!

Also a big thanks to xdavidhu for writing the python script to connect to Wireshark!


Download this project and extract the .zip file to the Arduino libraries folder.
For more information please read Installing Additional Arduino Libraries.


If you don't use an ESP32, you will need the SdFat library.

Following Arduino libraries are required for the included examples:

For the Serialshark script (the script located in extras):

Please be aware that the Serialshark script doesn't work on Windows!



To open one of the examples open Arduino and go to File>Examples>Arduino Pcap.
You might want to adjust the settings in the sketch (settings may be different depending on the example):

//===== SETTINGS =====//
#define CHANNEL 1
#define FILENAME "esp8266"
#define SAVE_INTERVAL 30 //save new file every 30s
#define CHANNEL_HOPPING true //if true it will scan on all channels
#define MAX_CHANNEL 11 //(only necessary if channelHopping is true)
#define HOP_INTERVAL 214 //in ms (only necessary if channelHopping is true)

Also note that when you use the ESP8266 most packets will be malformed or cut off at the end.
I don't know why the promiscuous mode returns this mostly false data, but it's still good enough to get some MAC addresses and SSIDs. I used it successfully in various projects to detect deauthentication packets, scan for client devices and build a low cost WiFi packet monitor.
But if you want something more reliable then have a look at the ESP32, its promiscuous mode is working way better.

Live capture using Wireshark

You also live capture the packets in Wireshark over the serial connection!
For that be sure to have everything installed - see Dependencies.

Flash your device and be sure it is connected.
Then start the (it's in the extras folder) with python3
It will ask you about about the serial port (you have to find that out), the baud rate (be sure it's the same as in your sketch) and where to save the pcap file (wherever you want).

The baudrate for the ESP32 example is 921600. The baudrate for the ESP8266 example is 115200.

Saving onto a SD-Card

For that you will need a SD-Card (obviously). You can connect it directly to the ESP8266/ESP32, but I recommend buying a SD-Card module/shield. Wire up the SPI connection (MOSI,MISO,SCL,CS,GND,VCC) to your module and basically you are ready to go!
[If you don't know which pins to connect to which, just search for a pinout picture of your module]

The included examples will save a new .pcap file every 30s. If you open the serial monitor in Arduino (baudrate is 115200), you will get some more information.


This project is licensed under the MIT License - see the license file for details.


A library for creating and sending .pcap files for Wireshark and other programms.








No releases published


No packages published