At the moment I think only AirPCAP is fully supported for doing this kind of work, and it costs in excess of $500. Unfortunately, the devices which implement these are not cheap. Both of these require explicit implementation. There's also another mode called "monitor mode" which allows you to receive all 802.11 frames regardless of which AP it came from. For promiscuous mode to work, the driver must explicitly implement functionality that allows every 802.11 frame associated with the currently connected access point, intended for that receiver or not, to be processed. Normally a driver would implement only the necessary code to receive and process 802.11 frames intended for it to receive. Running a WiFi adapter in promiscuous mode requires some additional work and support by the driver.
This is most noticeable on wired networks that use hubs instead of switches, where in non-promiscuous mode you will see only broadcast traffic and packets unicast to your adapter address, but in promiscuous mode you will see everything - in both cases your adapter is receiving every packet on the network, but in promiscuous mode the PCAP driver doesn't filter out packets not intended for your adapter. telling it to process packets regardless of their target address if the underlying adapter presents them. Wireshark has a setting called "promiscuous mode", but that does not directly enable the functionality on the adapter rather it starts the PCAP driver in promiscuous mode, i.e.
0 kommentar(er)
