[Winpcap-users] Is is possible to receive EAP packet without promiscuous mode?

[Bryan Kadzban]

bugtraq wrote:
> For Cisco switches, the destination MAC Address of EAP packet is 
> 01-80-C2-00-00-02. In order to receive such packets, shall I set the 
> Winpcap to work in promiscuous mode?
> 
> In other words, is there a way to receive such EAP packets without 
> promiscuous mode(with winpcap or other libraries)?

In this case, yes, I think there is.  Join the correct multicast group.

That MAC corresponds to a multicast address.  If you can get the NIC to
join that multicast group before the IP protocol is up, you should see
that traffic without promiscuous mode.

I have no idea whether this is possible (in Windows or any other OS),
though.  Normally joining a multicast group is done at the IP layer, so
if IP isn't up yet, it may not be possible.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 258 bytes
Desc: OpenPGP digital signature
Url : http://www.winpcap.org/pipermail/winpcap-users/attachments/20060921/8863ca19/signature.pgp