wireshark captures 72 packets then stops

I haven't found a wifi driver in monitor mode on Linux where this works. I found that selecting the checkbox for promiscuous mode has no effect here in any case - the driver either passes up the unicast frames or doesn't when in monitor mode. For instance, I still have trouble updating CentOS kernels sometimes because I think they backported the driver into their 2.x and 3.x series long term kernels. The RALink series had this defect roll in and then out through some kernels over the past few years, too - there were a series of 4.x kernels where it was stuck in this state.

For example, the carl9170 driver for some Atheros chipsets had this issue for many years it was fixed a year or two ago. Some adapters are known to support monitor mode but NOT promiscuous mode this gives the result that only broadcast/multicast (group) traffic is collected. Anyway, there are likely two causes for this behavior: Do NOT upload all of the files that were captured.It's still not clear exactly what you mean when you say unicast is this ANY unicast traffic, including mgmt/control, or just data frames? If you search this site and the previous version, this issue comes up routinely. Ideally, the desired packets captured will all be in a single file.

Upload only the file(s) that contain the packets corresponding to the issue or behavior observed.

Upload the corresponding file(s) to the support case.

It is good practice to allow a little bit of time to pass (1 minute or so) after the issue is observed unless the support engineer directs otherwise.

Define the interval for by checking checkbox for time, file size, and/or a cert ian number of packets and specify parameters accordingly.

Select the Output tab, and check the 'Create a new file automatically after.' checkbox.

In the Input tab, select the interface(s) from which to capture packets so that they are highlighted.Prepare the needed conditions to recreate the behavior of the issue in question.Follow these steps to make use of this function in Wireshark. This will create multiple packet capture files of the consecutive events separated by a defined interval of time, file size, and/or a certain number of packets. Make use of Wireshark's rolling captures.

Wireshark captures 72 packets then stops