raw monitoring

How can you tell if a wireless card supports raw monitoring?

bob@coolgroups.com hath wroth:

>How can you tell if a wireless card supports raw monitoring?

You run Ethereal and see if it can capture packets from other wireless
devices.
http://www.ethereal.com
If it can only capture packets to and from itself, it does NOT support
raw mode, monitor mode, promiscuous mode, snoop mode, or whatever else
it's called this week. The problem is described in the Ethereal FAQ
at:
http://www.ethereal.com/faq.html#promiscsniff


--
Jeff Liebermann jeffl@comix.santa-cruz.ca.us
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann AE6KS 831-336-2558

Jeff Liebermann wrote:
> bob@coolgroups.com hath wroth:
>
>> How can you tell if a wireless card supports raw monitoring?
>
> You run Ethereal and see if it can capture packets from other wireless
> devices.
> http://www.ethereal.com
> If it can only capture packets to and from itself, it does NOT support
> raw mode, monitor mode, promiscuous mode, snoop mode, or whatever else
> it's called this week. The problem is described in the Ethereal FAQ
> at:
> http://www.ethereal.com/faq.html#promiscsniff
>
>

Shouldn't folks be using wireshark currently <http://www.wireshark.org/>


John

John Mason Jr <notvalid@cox.net.invalid> hath wroth:

>Jeff Liebermann wrote:
>> bob@coolgroups.com hath wroth:
>>
>>> How can you tell if a wireless card supports raw monitoring?
>>
>> You run Ethereal and see if it can capture packets from other wireless
>> devices.
>> http://www.ethereal.com
>> If it can only capture packets to and from itself, it does NOT support
>> raw mode, monitor mode, promiscuous mode, snoop mode, or whatever else
>> it's called this week. The problem is described in the Ethereal FAQ
>> at:
>> http://www.ethereal.com/faq.html#promiscsniff

>Shouldn't folks be using wireshark currently <http://www.wireshark.org/>
>John

Yes. It depends on your political position over the ownership of the
Ethereal name by the authors former employer. I don't wanna go into
the details. Ethereal is slightly dated, while Wireshark has had some
recent bug fixes and additions. Give me a few years to get used to
the new name.

Incidentally, if you wanna do promiscuous sniffing under Windoze, it's
possibly easier to just buy an adapter and driver that supports
promiscuous mode. See:
http://www.cacetech.com/products/airpcap.htm
$198. Basically, you're buying a non-Microsoft driver for a commodity
USB wi-fi radio, that works with Ethereal/Wireshark, Angry IP,
WinDump, Dice, etc. I would buy one if the USB device had an external
antenna connector, but I guess not. They also sell a collection of
Windoze network tools:
http://www.cacetech.com/products/toolkit.htm
$40 for one time download or $90 for a 1 year subscription. Ouch.

--
Jeff Liebermann jeffl@comix.santa-cruz.ca.us
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann AE6KS 831-336-2558

Jeff Liebermann wrote:
> John Mason Jr <notvalid@cox.net.invalid> hath wroth:
>
>> Jeff Liebermann wrote:
>>> bob@coolgroups.com hath wroth:
>>>
>>>> How can you tell if a wireless card supports raw monitoring?
>>> You run Ethereal and see if it can capture packets from other wireless
>>> devices.
>>> http://www.ethereal.com
>>> If it can only capture packets to and from itself, it does NOT support
>>> raw mode, monitor mode, promiscuous mode, snoop mode, or whatever else
>>> it's called this week. The problem is described in the Ethereal FAQ
>>> at:
>>> http://www.ethereal.com/faq.html#promiscsniff
>
>> Shouldn't folks be using wireshark currently <http://www.wireshark.org/>
>> John
>
> Yes. It depends on your political position over the ownership of the
> Ethereal name by the authors former employer. I don't wanna go into
> the details. Ethereal is slightly dated, while Wireshark has had some
> recent bug fixes and additions. Give me a few years to get used to
> the new name.
>
> Incidentally, if you wanna do promiscuous sniffing under Windoze, it's
> possibly easier to just buy an adapter and driver that supports
> promiscuous mode. See:
> http://www.cacetech.com/products/airpcap.htm
> $198. Basically, you're buying a non-Microsoft driver for a commodity
> USB wi-fi radio, that works with Ethereal/Wireshark, Angry IP,
> WinDump, Dice, etc. I would buy one if the USB device had an external
> antenna connector, but I guess not. They also sell a collection of
> Windoze network tools:
> http://www.cacetech.com/products/toolkit.htm
> $40 for one time download or $90 for a 1 year subscription. Ouch.
>

I don't know the backstory behind the name change.

I'll stick with linux based tools, I looked at the website but don't
have any reason to stick with Windows for these types of tasks.

I realy don't see a reason to buy the toolkit when Live CDs like
backtrack will do the job and more


John