Wireshark is a powerful tool for network analysis, but on Windows, capturing raw 802.11 Wi-Fi frames isn't straightforward. Most Wi-Fi drivers on Windows, including those for the TP-Link Archer T4U, do not support monitor mode. To overcome this, we can use VirtualBox to set up a Linux virtual machine (VM) that can capture raw Wi-Fi packets using the TP-Link Archer T4U. The Archer T4U is a separate WiFi dongle that will be used.

Here's a step-by-step guide to achieve this.

Step 1: Install VirtualBox on Windows

Download the latest version of VirtualBox for Windows from the official website.
Run the installer and follow the prompts to complete the installation.
Once installed, download and install the VirtualBox Extension Pack. The Extension Pack provides support for USB 2.0/3.0 devices, essential for using the TP-Link Archer T4U with the VM.

Step 2: Download & Install a Linux Distribution

Download a Linux distribution such as Ubuntu or Kali Linux. Both are capable of Wi-Fi packet capture.
- Kali Linux is recommended for advanced network analysis tools pre-installed.
- Ubuntu is simpler and requires manual installation of Wireshark and related tools.
Create a new VM in VirtualBox:
- Open VirtualBox and click New.
- Assign a name, choose Linux as the type, and select the appropriate version.
- Allocate at least 2 GB of RAM and 20 GB of disk space.
Attach the downloaded Linux ISO file to the VM:
- Go to Settings > Storage.
- Click the Empty slot under the Controller and attach the ISO file by clicking the disc icon.
Boot the VM and follow the installation steps for your chosen Linux distribution.

Step 3: Configure the TP-Link Archer T4U for Use in the VM

Plug the TP-Link Archer T4U into your Windows laptop.
In VirtualBox, connect the USB device to the VM:
- Start the Linux VM.
- Once the VM is running, go to Devices > USB and select the TP-Link Archer T4U from the list.
Verify that the device is recognized in the Linux VM:
- Open a terminal and run:
```
  lsusb
```
- Look for the TP-Link Archer T4U in the output.

Step 4: Install Wireshark & Dependencies on Linux

Update the package manager:
```
 sudo apt update
```

Install Wireshark and supporting tools:

 sudo apt install wireshark aircrack-ng

Add your user to the Wireshark group to run it without root privileges:
```
 sudo usermod -aG wireshark $(whoami)
```
- Log out and back in to apply the changes.

Step 5: Enable Monitor Mode

Identify the network interface for the TP-Link Archer T4U:
```
 iwconfig
```
- The output should list interfaces like wlan0 or similar.
Enable monitor mode on the interface:
```
 sudo airmon-ng start wlan0
```
- This will switch the interface to monitor mode. You might see the interface renamed (e.g., wlan0mon).

Step 6: Capture Raw Wi-Fi Packets in Wireshark

Start Wireshark in Linux:
```
 wireshark
```
Select the wireless interface in monitor mode (e.g., wlan0mon).
Set the capture filter to exclude irrelevant traffic if necessary:
```
 wlan
```
Begin capturing packets. You'll now see raw 802.11 frames, including management, control, and data frames.

Step 7: Analyze the Captured Packets

Management frames (e.g., Beacon, Probe Request/Response) reveal network details like SSIDs, BSSIDs, and supported capabilities.
Control frames (e.g., RTS/CTS) help manage the flow of traffic.
Data frames contain payload information but may be encrypted depending on the network.

Use Wireshark’s built-in filters to narrow down specific packet types or addresses.

Step 8: Save and Export Captures

Save your captures as .pcap files for later analysis:
```
  File > Save As
```
Export specific packet details or statistics for reporting purposes.

Tips for Best Results

Ensure no other network processes interfere with monitor mode.
For encrypted traffic, you’ll need the Wi-Fi network’s passphrase and must capture the four-way handshake to decrypt packets.
Avoid running other applications in the VM to reduce lag.

This method allows you to effectively analyze raw Wi-Fi packets using the TP-Link Archer T4U. By leveraging VirtualBox and Linux, you can bypass Windows’ limitations, enabling advanced Wi-Fi analysis on your laptop.

🦈Analyzing Raw Wi-Fi Packets on a Windows Laptop Using a TP-Link Archer T4U🏖️