Ethereal-users: RE: [Ethereal-users] Ethereal in Win2K

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "darren" <teodarren@xxxxxxxxx>
Date: Sun, 18 Nov 2001 15:49:02 +0800
Dear All!

Thanx for replying to my posting.

The Aironet 350 is running on the Prism2 Chipset and should be able to
be used in Prom mode. There are currently two other windows proggie that
uses the Aironet 350, namely Sniffer Wireless and Airopeek, but both of
them comes with alternative drivers for use with the WiFi card.

I had this idea, first, install and run airopeek, this will set the WLAN
card into listen mode (and hopefully Promiscuous mode - airopeek demo
version was happily showing me all the beacon signals it picked up on my
card and thus the prom mode shld be working as advertised). THEN run
Ethereal in the background and use it like normal.

I have tried out the procedure I have described above but could not get
Ethereal to pick up any packets other then those to or from my own card.
However, the airopeek proggie running in the back could pick up lots of
other things. 

I am not sure what I did wrong. Any suggestions?

Regards
Darren

p.s. All I want to do is to sniff WLAN in windows mode!!!
-----Original Message-----
From: Joerg Mayer [mailto:jmayer@xxxxxxxxx] 
Sent: Sunday, November 18, 2001 5:23 AM
To: Guy Harris
Cc: darren; ethereal-users@xxxxxxxxxxxx
Subject: Re: [Ethereal-users] Ethereal in Win2K

On Sat, Nov 17, 2001 at 01:00:59PM -0800, Guy Harris wrote:
> 	   filter (OID_GEN_CURRENT_PACKET_FILTER) to
> 	   NDIS_PACKET_TYPE_PROMISCUOUS, turns on promiscuous mode.
> 
> You would have to ask the supplier of the card whether it supports
> promiscuous mode.  (A search for "+aironet +promiscuous" on the Cisco
> Web site found nothing from Cisco to indicate whether it does or not.)
> 
> If it does, you would have to ask the supplier of the driver (whether
> it's Microsoft, Cisco, or whoever) whether the driver turns on
> promiscuous mode when asked to.
> 
> If you then told us what they said, we could put that in the FAQ, and
> subsequent discussion of that question would not be inconclusive.

I asked a cisco guy at the networkers in copenhagen about this and he
told me that old firmware versions were able to turn on promisc but
current firmware releases have this feature disabled. Looks like it
was disabled to prevent snooping. This is just from talking to a tech
guy, so it's not "official", nor is the reason. Maybe Gilbert can
find out more?
I have not been able to turn promisc on with a current card+fw with a
card I borrowed from a friend - thus I didn't buy one in the end.

  Ciao
           Jörg

--
Joerg Mayer                                          <jmayer@xxxxxxxxx>
I found out that "pro" means "instead of" (as in proconsul). Now I know
what proactive means.


_________________________________________________________
Do You Yahoo!?
Get your free @yahoo.com address at http://mail.yahoo.com