[Winpcap-users] error while building winpcap

[Joshua (Shiwei) Zhao]

I guess what we got is the "monitor mode".
Thanks a lot for the education!!!  I'll see what I can do about that :)

Joshua


On Thu, Nov 20, 2008 at 11:59 AM, Guy Harris <guy at alum.mit.edu> wrote:
>
> On Nov 20, 2008, at 10:55 AM, Joshua (Shiwei) Zhao wrote:
>
>>> How do you configure your WiFi driver to go into promiscuous mode? Is it
>>> done through the usual
>>> OID_GEN_CURRENT_PACKET_FILTER, a custom OID code or some other mechanism?
>>>
>> We know from the manufacturer how to set their driver to that mode.
>
> So what is "that mode"?
>
> Note that, at least as I understand it, some if not all wireless adapters
> support a promiscuous mode that's similar to Ethernet promiscuous mode, in
> that the adapter is associated with a network, and drops packets for other
> networks, but *does* provide to the host packets that aren't unicasts to the
> adapter, broadcasts, or multicasts to a multicast address for which the
> adapter is accepting packets.
>
> If so, then a Windows adapter for that driver should, if it's told to set
> the OID_GEN_CURRENT_PACKET_FILTER OID to NDIS_PACKET_TYPE_PROMISCUOUS:
>
>        http://msdn.microsoft.com/en-us/library/bb648512.aspx
>
> should put the adapter into promiscuous mode - *that's* how the driver
> should be put in that mode.
>
> If the driver supports that, *no* changes to WinPcap are necessary to
> support it.
>
> If the driver requires anything else to put it into that mode, the driver
> isn't a good NDIS driver, and should be fixed.
>
> Now, wireless adapters might also support "monitor mode", which is not the
> same thing as promiscuous mode.  In monitor mode, the adapter will provide
> to the host all packets it receives, regardless of what network they're on.
>
> If *that's* what you mean, WinPcap doesn't currently support that.  Prior to
> Vista, Windows NDIS didn't support monitor mode; in Vista, with NDIS 6.0 it
> supports it:
>
>        http://msdn.microsoft.com/en-us/library/aa503132.aspx
>
> Note that Microsoft seem to indicate that promiscuous mode should be
> supported only when in monitor mode:
>
>        http://msdn.microsoft.com/en-us/library/aa503317.aspx
>
> and, apparently, in monitor mode, a driver must not send packets, so you
> can't be on a network and run in promiscuous mode.
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>