First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
0

Win10 can't set monitor mode on

  • retag add tags

Hi,

I have two questions

  1. what is the difference between monitor mode and promiscuous mode?
  2. Why I can't apply to monitor mode on my Win10 OS?
  3. Why is the link layer header type ....

I have three questions

  1. what is the difference between monitor mode and promiscuous mode?
  2. Why I can't apply to monitor mode on my Win10 OS?
  3. Why is the link-layer header type ethernet not 802.11 or wifi something?

The Wireless NIC that I used is Asus PCIE-AC88 which supporting 802.11 and the Wireshark version is 2.6.1


PS: Couldn't resist making this joke (see link)

Moose's avatar
1
Moose
asked 2018-05-30 05:38:55 +0000
Jaap's avatar
13.7k
Jaap
updated 2018-05-30 08:35:09 +0000
edit flag offensive 0 remove flag close merge delete

Comments

I can comment a bit. Monitor mode has to do with what the Wifi receiver will (try to) pick up at the Wifi MAC layer. Promiscuous mode has to do with what the Ethernet layer, on top of the Wifi driver, will let through. The link layer type has to do what kind of frames you get from the driver. When monitor mode is enabled you would see all Wifi frames, also those not carrying pure Ethernet MAC frames and therefore you get 802.11 link layer header type frames. When not in monitor mode the driver will hand you the received Ethernet MAC frames, with that link layer header type.

Jaap's avatar Jaap (2018-05-30 08:43:00 +0000) edit

Thanks a lot, that quite makes me more understanding.

Moose's avatar Moose (2018-05-31 02:14:26 +0000) edit
add a comment see more comments

1 Answer

0

You might find some answers on the wiki page for WLAN Capture Setup.

grahamb's avatar
23.8k
grahamb
answered 2018-05-30 08:36:19 +0000
edit flag offensive 0 remove flag delete link

Comments

I saw a sentence from the WiKi, "Unfortunately, WinPcap doesn't support monitor mode and, on Windows," Is that the root cause of Win10 can't enable monitor mode?

Moose's avatar Moose (2018-05-31 00:56:39 +0000) edit

It said Npcap supporting monitor mode and raw 802.11 traffic. After installed Npcap, yes, it did really able to capture wifi traffic with the promiscuous mode, but monitor mode still not able to activate. So, I'm curious about is it only certain wireless NIC would be supported by Wireshark?

Moose's avatar Moose (2018-05-31 02:18:58 +0000) edit

WinPcap doesn't support monitor mode at all.

npcap does, but it still depends on the NIC driver to implement it. Historically support for this on Windows (all versions) has been poor.

grahamb's avatar grahamb (2018-05-31 08:45:21 +0000) edit

OKay, thanks for your feedback. I'm going to find another wireless NIC for testing. Thanks.

Moose's avatar Moose (2018-05-31 08:53:51 +0000) edit

Another option would be to boot your machine into Linux, Kali Linux seems to be popular for this sort of thing and instructions for making a bootable USB drive are here.

grahamb's avatar grahamb (2018-05-31 09:01:53 +0000) edit
add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer