Wi‑Fi Troubleshooting: Capture Filter, Wrong Interface, Empty PCAP

March 31, 2026 • Wi‑Fi • Lab-Safe Note

If your adapter is in monitor mode but Wireshark (or tcpdump) shows nothing, you are often capturing from the wrong interface, applying a capture filter that excludes everything, or confusing capture filters with display filters.

Permission-first: only capture on networks you own or have explicit written authorization to assess. See Legal & Ethics.

1) Managed vs monitor interface names

Many drivers expose wlan0 for managed mode and wlan0mon (or similar) for monitor mode. Capturing on wlan0 while monitor mode is enabled on wlan0mon yields an empty or misleading trace.

Confirm with iw dev / OS UI which interface is actually in monitor mode.
Select that exact interface in your capture tool.

2) Capture filter vs display filter (Wireshark)

Capture filter: applied by the kernel/libpcap before packets are saved. Too strict = empty PCAP.
Display filter: only changes what you see after capture; it does not create new packets.
Start with no capture filter while validating the path, then narrow.

3) Channel and band still matter

The right interface with the wrong channel still produces silence for off-channel traffic. Pair interface checks with the channel/band workflow in the long guide.

Next step

For the full workflow (beacons, data frames, WPA details), continue with Wi‑Fi: handshakes and capture troubleshooting and beacons-only symptom guide.