Cybersecurity blog header

Wi-Fi Sniffer for Windows and 802.11 packet viewer

Acrylic Suite is a software developed by Tarlogic team that provides a powerful WiFi sniffer to analyse communications and WiFi security on Windows 11 and Windows 10 computers.

To quickly turn any Windows computer into a powerful Wi-Fi network sniffer, we only need two things:

  • A WiFi card.
  • Install the Acrylic Wi-Fi Sniffer software.
Wi-Fi sniffer wifi

WiFi network signal sniffer

In this article we will explain how to carry out this task on Windows and access to all the WiFi information and to the 802.11 communication frames in the 2.4Ghz, 5Ghz and 6Ghz frequency bands.

WiFi card with monitor mode support

The first step to detect WiFi signals with our sniffer is to have an USB card or an integrated WiFi card that can capture data packets traveling through the air.

sniffer installation

Sniffer searching for compatible WiFi cards under Windows

Usually, LAN adapters and WiFi devices will discard data that is not addressed to them. Therefore, in order to intercept all data packets, the card must be set into a special mode called “monitor mode“, similar to the “promiscuous mode” of an ethernet network card.

To activate this mode in Windows, we need a card supported by Acrylic Wi-Fi Sniffer. This should not be a problem as the compatible Wi-Fi cards list for our sniffer is very extensive and includes modern 802.11ac cards such as the ALPHA cards.

Installing Acrylic Wi-Fi Sniffer

After installing Acrylic Wi-Fi Sniffer, all compatible cards will show up when starting the software.

compatible wifi cards

WiFi cards available for use as a device sniffer

When Acrylic Wi-Fi Sniffer cannot enable monitor mode on the installed WiFI card using its driver we can use NDIS driver, by installing it in the program control panel.

NDIS is a native Windows mechanism to turn a card into a Wi-Fi sniffer. Unfortunately, Microsoft lack of support for this technology and the lack of support from manufacturers means that it does not always work optimally and it has certain technical limitations, so NDIS is Acrylic plan B for sniffing.

Using the Sniffer: Wireshark or Acrylic Wi-Fi Analyzer

Once the WiFi card is connected and Acrylic Wi-Fi Sniffer is installed, the next step is to use a sniffer program that can display the data.

Using Wireshark as a sniffer

If you are used to work with a traffic analyser like Wireshark, it&#x27s easy. First of all, install Wireshark 3.x.

Next, click on the “Install integration” button to allow Wireshark 3 to interact with Acrylic Wi-Fi Sniffer. Then run Wireshark as administrator. That&#x27s it. The monitor mode Wi-Fi interface will be available to start capturing.

Using wireshark as a windows wifi sniffer

Using Wireshark with a WiFi interface

Here is a video on how to use Acrylic WiFi Sniffer with Wireshark, capturing WiFi frames on a specific channel:

Using Acrylic Wi-Fi Analyzer

If you are more interested in using a graphical diagnostic tool, to graphically navigate and visualise all the information without losing the power of a WiFi packet viewer, we recommend you to try Acrylic Wi-Fi Analyer.

Graphical wifi sniffer UI

Graphical Sniffer: Showing connected WiFi devices

The necessary steps are as follows:

  • Install Acrylic Wi-Fi Analyzer
  • Start Acrylic Wi-Fi Analyzer as administrator.
  • Select a WiFi card that supports monitor mode (sniffer mode).
selecting monitor mode wifi card

Selecting monitor mode for WiFi traffic capture.

  • Close this window and start the capture by clicking on the start button.
  • Within seconds nearby WiFi devices will start showing up.
sniffer capring wireless network information

WiFi networks captured by the sniffer

A quick way to check if we are using a sniffer with the card set in “monitor mode” is to look at the number shown next to the network name (SSID). This number indicates the number of WiFi devices connected to the network (tablets, laptops, smartphones, Smart tvs,…).

The devices tab will display all nearby devices.

wifi devices

Active WiFi devices

Part of the sniffer functionality can be found in the “Packet Analyser” tab., which displays Wi-Fi frames and the content of all packets

wifi packets

WiFi data packet captured by the sniffer

Of course, Acrylic Wi-Fi Analyzer allows you to do a lot more: test network performance, latency, signal levels, channels, manage inventory, save and open traffic captures (pcap)…

You can buy Acrylic Wi-Fi Analyzer and Acrylic Wi-Fi sniffer bundle license in our online shop. Thank you for supporting us!