[Winpcap-users] Can't capture 802.11 management frame

[Guy Harris]

On Jun 19, 2009, at 4:40 PM, Wei Gao wrote:

> Thank you very much for the tips. We are running on Vista and  
> Windows 7, so there is always native wi-fi support. It looks like we  
> can not get management or control frame via winpcap on Vista/Win7.  
> Could you or somebody confirm? I found an email discussion from  
> Gianluca as attached. Is that what you refer to?

Yes, that's what I'm referring to.  As Gianluca said:

	At the moment there are no current plans to support native WiFi in  
WinPcap, although I've definitely been thinking about it. The main  
problem in supporting it is that it's not trivial, it basically  
requires to rewrite all the kernel module of WinPcap in order to be an  
NDIS6 filter driver (and as consequence, a lot of the installation  
code).

> I follow your link and track down the following information as in  
> the below link. Is that exactly how Native Wi-Fi supports this?
> http://msdn.microsoft.com/en-us/library/aa503317.aspx

That's *part* of it.  However, it says:

	Note  It is only valid for the miniport driver to enable the  
NDIS_PACKET_TYPE_PROMISCUOUS,  
NDIS_PACKET_TYPE_802_11_PROMISCUOUS_MGMT, or  
NDIS_PACKET_TYPE_802_11_PROMISCUOUS_CTRL packet filters if the driver  
is operating in Network Monitor (NetMon) mode. For more information  
about this mode, see Network Monitor Operation Mode.

so you also have to enable monitor mode, which is what

	http://msdn.microsoft.com/en-us/library/aa503132.aspx

is about.