[Winpcap-users] What does WinPcap do when setting a 802.11wireless NIC into promiscuous mode?

[Gianluca Varenni]

What you are reading is the documentation for an NDIS 6.0 driver. WinPcap is still an NDIS 5.x one, so the NDIS_PACKET_TYPE_802_11_xxxx filters are not usable from WinPcap. I don't know exactly what the NDIS 5x <--> 6.0 thunking layer does when you set the promiscuous mode, however.

GV
  ----- Original Message ----- 
  From: yu-ruei woo 
  To: winpcap-users at winpcap.org 
  Sent: Monday, August 31, 2009 11:10 PM
  Subject: Re: [Winpcap-users] What does WinPcap do when setting a 802.11wireless NIC into promiscuous mode?


  Hi,


  After tracing the source code, I found that in PacketSetHwFilter, you set the packet filter NDIS_PACKET_TYPE_PROMISCUOUS is true. Otherwise the packet filter is set to NDIS_PACKET_TYPE_ALL_LOCAL.


  In the WDK documentation, it says:
  It is only valid for the miniport driver to enable the NDIS_PACKET_TYPE_PROMISCUOUS, NDIS_PACKET_TYPE_802_11_PROMISCUOUS_MGMT, or NDIS_PACKET_TYPE_802_11_PROMISCUOUS_CTRL packet filters if the driver is operating in Network Monitor (NetMon) mode.


  But in the source code, I can't find any request to the driver that sets its operation mode to NetMon mode.


  So I think setting promiscuous mode in WireShard will have to effect on the NIC if the NIC driver follows the WDK documentation.


  Is that right?


  Best regards, 
  Haich


  On Tue, Sep 1, 2009 at 10:49 AM, yu-ruei woo <haich.woo at gmail.com> wrote:

Hi,I am recently modifying a WLAN driver such that it can receive 802.11 packets without filtering packets destined to other STA in the same BSS while keep the connection with the BSS. I've tried the promiscuous mode, but I found that no OID is set to the WLAN driver to notify the driver that it should now operate in promiscuous mode.I would like to know what does WinPcap do when setting a WLAN NIC into promiscuous receiving mode. Specifically, how does WinPcap notify the WLAN NIC that it should operate in promiscuous mode.Best regards,Haich



------------------------------------------------------------------------------


  _______________________________________________
  Winpcap-users mailing list
  Winpcap-users at winpcap.org
  https://www.winpcap.org/mailman/listinfo/winpcap-users
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20090901/1b7d5ba5/attachment.htm