[Winpcap-users] Is is possible to receive EAP packet without promiscuous mode?

[bugtraq]

Thanks for reply.

The Microsoft 802.1x client for Windows 2000/XP/2003 can receive EAP
packet without promiscuous mode. I think it works in the way you said.


On Thu, 21 Sep 2006 07:04:02 -0400
Bryan Kadzban <bryan at kadzban.is-a-geek.net> wrote:

> bugtraq wrote:
> > For Cisco switches, the destination MAC Address of EAP packet is 
> > 01-80-C2-00-00-02. In order to receive such packets, shall I set the 
> > Winpcap to work in promiscuous mode?
> > 
> > In other words, is there a way to receive such EAP packets without 
> > promiscuous mode(with winpcap or other libraries)?
> 
> In this case, yes, I think there is.  Join the correct multicast group.
> 
> That MAC corresponds to a multicast address.  If you can get the NIC to
> join that multicast group before the IP protocol is up, you should see
> that traffic without promiscuous mode.
> 
> I have no idea whether this is possible (in Windows or any other OS),
> though.  Normally joining a multicast group is done at the IP layer, so
> if IP isn't up yet, it may not be possible.

-- 
bugtraq <bugtraq at 163.com>