Ask Your Question
0

Win10 can't set monitor mode on

asked 2018-05-30 05:38:55 +0000

Moose gravatar image

updated 2018-05-30 08:35:09 +0000

Jaap gravatar image

Hi,

I have two questions

  1. what is the difference between monitor mode and promiscuous mode?
  2. Why I can't apply to monitor mode on my Win10 OS?
  3. Why is the link layer header type ....

I have three questions

  1. what is the difference between monitor mode and promiscuous mode?
  2. Why I can't apply to monitor mode on my Win10 OS?
  3. Why is the link-layer header type ethernet not 802.11 or wifi something?

The Wireless NIC that I used is Asus PCIE-AC88 which supporting 802.11 and the Wireshark version is 2.6.1

PS: Couldn't resist making this joke (see link)

edit retag flag offensive close merge delete

Comments

I can comment a bit. Monitor mode has to do with what the Wifi receiver will (try to) pick up at the Wifi MAC layer. Promiscuous mode has to do with what the Ethernet layer, on top of the Wifi driver, will let through. The link layer type has to do what kind of frames you get from the driver. When monitor mode is enabled you would see all Wifi frames, also those not carrying pure Ethernet MAC frames and therefore you get 802.11 link layer header type frames. When not in monitor mode the driver will hand you the received Ethernet MAC frames, with that link layer header type.

Jaap gravatar imageJaap ( 2018-05-30 08:43:00 +0000 )edit

Thanks a lot, that quite makes me more understanding.

Moose gravatar imageMoose ( 2018-05-31 02:14:26 +0000 )edit
add a comment

1 Answer

Sort by ยป oldest newest most voted
0

answered 2018-05-30 08:36:19 +0000

grahamb gravatar image

You might find some answers on the wiki page for WLAN Capture Setup.

edit flag offensive delete link more

Comments

I saw a sentence from the WiKi, "Unfortunately, WinPcap doesn't support monitor mode and, on Windows," Is that the root cause of Win10 can't enable monitor mode?

Moose gravatar imageMoose ( 2018-05-31 00:56:39 +0000 )edit

It said Npcap supporting monitor mode and raw 802.11 traffic. After installed Npcap, yes, it did really able to capture wifi traffic with the promiscuous mode, but monitor mode still not able to activate. So, I'm curious about is it only certain wireless NIC would be supported by Wireshark?

Moose gravatar imageMoose ( 2018-05-31 02:18:58 +0000 )edit

WinPcap doesn't support monitor mode at all.

npcap does, but it still depends on the NIC driver to implement it. Historically support for this on Windows (all versions) has been poor.

grahamb gravatar imagegrahamb ( 2018-05-31 08:45:21 +0000 )edit

OKay, thanks for your feedback. I'm going to find another wireless NIC for testing. Thanks.

Moose gravatar imageMoose ( 2018-05-31 08:53:51 +0000 )edit

Another option would be to boot your machine into Linux, Kali Linux seems to be popular for this sort of thing and instructions for making a bootable USB drive are here.

grahamb gravatar imagegrahamb ( 2018-05-31 09:01:53 +0000 )edit
add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

subscribe to rss feed

Stats

Asked: 2018-05-30 05:38:55 +0000

Seen: 25,534 times

Last updated: May 30 '18