# 🦈Analyzing Raw Wi-Fi Packets on a Windows Laptop Using a TP-Link Archer T4U🏖️

Wireshark is a powerful tool for network analysis, but on Windows, capturing raw 802.11 Wi-Fi frames isn't straightforward. Most Wi-Fi drivers on Windows, including those for the TP-Link Archer T4U, do not support monitor mode. To overcome this, we can use VirtualBox to set up a Linux virtual machine (VM) that can capture raw Wi-Fi packets using the TP-Link Archer T4U. The Archer T4U is a separate WiFi dongle that will be used.

Here's a step-by-step guide to achieve this.

---

## **Step 1: Install VirtualBox on Windows**

1. Download the latest version of [**VirtualBox**](https://www.virtualbox.org/) for Windows from the official website.
    
2. Run the installer and follow the prompts to complete the installation.
    
3. Once installed, download and install the **VirtualBox Extension Pack**. The Extension Pack provides support for USB 2.0/3.0 devices, essential for using the TP-Link Archer T4U with the VM.
    

---

## **Step 2: Download & Install a Linux Distribution**

1. Download a Linux distribution such as **Ubuntu** or **Kali Linux**. Both are capable of Wi-Fi packet capture.
    
    * **Kali Linux** is recommended for advanced network analysis tools pre-installed.
        
    * **Ubuntu** is simpler and requires manual installation of Wireshark and related tools.
        
2. Create a new VM in VirtualBox:
    
    * Open VirtualBox and click **New**.
        
    * Assign a name, choose **Linux** as the type, and select the appropriate version.
        
    * Allocate at least 2 GB of RAM and 20 GB of disk space.
        
3. Attach the downloaded Linux ISO file to the VM:
    
    * Go to **Settings > Storage**.
        
    * Click the **Empty** slot under the Controller and attach the ISO file by clicking the disc icon.
        
4. Boot the VM and follow the installation steps for your chosen Linux distribution.
    

---

## **Step 3: Configure the TP-Link Archer T4U for Use in the VM**

1. Plug the TP-Link Archer T4U into your Windows laptop.
    
2. In VirtualBox, connect the USB device to the VM:
    
    * Start the Linux VM.
        
    * Once the VM is running, go to **Devices > USB** and select the TP-Link Archer T4U from the list.
        
3. Verify that the device is recognized in the Linux VM:
    
    * Open a terminal and run:
        
        ```plaintext
        lsusb
        ```
        
    * Look for the TP-Link Archer T4U in the output.
        

---

## **Step 4: Install Wireshark & Dependencies on Linux**

1. Update the package manager:
    
    ```plaintext
    sudo apt update
    ```
    
2. Install Wireshark and supporting tools:
    
    ```plaintext
    sudo apt install wireshark aircrack-ng
    ```
    
3. Add your user to the Wireshark group to run it without root privileges:
    
    ```plaintext
    sudo usermod -aG wireshark $(whoami)
    ```
    
    * Log out and back in to apply the changes.
        

---

## **Step 5: Enable Monitor Mode**

1. Identify the network interface for the TP-Link Archer T4U:
    
    ```plaintext
    iwconfig
    ```
    
    * The output should list interfaces like `wlan0` or similar.
        
2. Enable monitor mode on the interface:
    
    ```plaintext
    sudo airmon-ng start wlan0
    ```
    
    * This will switch the interface to monitor mode. You might see the interface renamed (e.g., `wlan0mon`).
        

---

## **Step 6: Capture Raw Wi-Fi Packets in Wireshark**

1. Start Wireshark in Linux:
    
    ```plaintext
    wireshark
    ```
    
2. Select the wireless interface in monitor mode (e.g., `wlan0mon`).
    
3. Set the capture filter to exclude irrelevant traffic if necessary:
    
    ```plaintext
    wlan
    ```
    
4. Begin capturing packets. You'll now see raw 802.11 frames, including management, control, and data frames.
    

---

## **Step 7: Analyze the Captured Packets**

* Management frames (e.g., Beacon, Probe Request/Response) reveal network details like SSIDs, BSSIDs, and supported capabilities.
    
* Control frames (e.g., RTS/CTS) help manage the flow of traffic.
    
* Data frames contain payload information but may be encrypted depending on the network.
    

Use Wireshark’s built-in filters to narrow down specific packet types or addresses.

---

## **Step 8: Save and Export Captures**

* Save your captures as `.pcap` files for later analysis:
    
    ```plaintext
    File > Save As
    ```
    
* Export specific packet details or statistics for reporting purposes.
    

---

## **Tips for Best Results**

* Ensure no other network processes interfere with monitor mode.
    
* For encrypted traffic, you’ll need the Wi-Fi network’s passphrase and must capture the four-way handshake to decrypt packets.
    
* Avoid running other applications in the VM to reduce lag.
    

---

This method allows you to effectively analyze raw Wi-Fi packets using the TP-Link Archer T4U. By leveraging VirtualBox and Linux, you can bypass Windows’ limitations, enabling advanced Wi-Fi analysis on your laptop.

---