tcpdump promiscuous mode on OSX 10.8

Question

By examining my wireless router configuration I can see there's 2 IPs assigned:

• 192.168.1.100 -> laptop (Macbook Air OSX 10.8.2, where I runtcpdump)

• 192.168.1.101 -> ipad

But then if I run:

sudo tcpdump -i en0 host 192.168.1.101

I can't seem to get significant traffic to or from my iPad. tcpdump seems to be capturing some packages from time to time but doing some wireless activity (e.g. browsing the web) generates no entries at all. Note that I have wifi security (WEP/WPA) disabled for this test.

Any idea what may I be doing wrong here?

EDIT: ifconfig en0

ifconfig en0 output, as asked:

en0: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
    ether 98:fe:94:45:36:8a 
    inet6 fe80::9afe:94ff:fe45:368a%en0 prefixlen 64 scopeid 0x4 
    inet 192.168.1.100 netmask 0xffffff00 broadcast 192.168.1.255
    media: autoselect
    status: active

EDIT: ifconfig (all)

full ifconfig output (note that it's a macbook air with no ethernet port):

lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
    options=3<RXCSUM,TXCSUM>
    inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1 
    inet 127.0.0.1 netmask 0xff000000 
    inet6 ::1 prefixlen 128 
gif0: flags=8010<POINTOPOINT,MULTICAST> mtu 1280
stf0: flags=0<> mtu 1280
en0: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
    ether 98:fe:94:45:36:8a 
    inet6 fe80::9afe:94ff:fe45:368a%en0 prefixlen 64 scopeid 0x4 
    inet 192.168.1.100 netmask 0xffffff00 broadcast 192.168.1.255
    media: autoselect
    status: active
p2p0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 2304
    ether 0a:fe:94:45:36:8a 
    media: autoselect
    status: inactive

EDIT: about promiscuous mode

For the ones saying that my macbook-air wireless port can't be put into promiscuous mode (ifconfig en0 prmoisc yields bad value), I can tell you that following the steps described here I can put my airport on promiscuous mode. I just want to be able to do it with tcpdump.

Answer 1

Try with -I (uppercase i) and -n

sudo tcpdump -In -i en0 host 192.168.1.101

OS X tcpdump(1) quote

-I Put the interface in "monitor mode"; this is supported only on IEEE 802.11 Wi-Fi interfaces, and supported only on some operating systems.

-n Don't convert addresses (i.e., host addresses, port numbers, etc.) to names.

-n is used because dns properly will not work if there is not wifi connection.

PS1: Wifi interface has to be on

PS2: Wifi connection properly will be lost, eg, no web surfing when capturing

PS3: -I is for WiFi

Answer 2

From here:

https://stackoverflow.com/questions/6591375/ifconfig-and-interfaces

By default, en0 and en1 are your physical network connections (wired and wireless LAN).

You've essentially configured your ethernet connection as promiscuous, not your wireless connection. Change your tcpdump to use your en1 interface instead. Make sure you configure it to be promiscuous as well.