Frequently Asked Questions

Q. Can 802.11 WLAN miniports be placed in promiscuous mode?

A. No, at least under NDIS 5.X.

Not all NDIS miniport provide support for promiscuous mode...

In particular, NDIS 5.X miniports for 802.11 adapters do NOT support setting the NDIS packet filter to NDIS_PACKET_TYPE_PROMISCUOUS. If you attempt to set the packet filter to NDIS_PACKET_TYPE_PROMISCUOUS the adapter will fail the set information request.

bulletThis is NOT a limitation of any NDIS protocol driver (such as Rawether) that you may be using.
bulletThis is the behavior of 802.11 miniports.

On 802.11 adapters you can successfully set the NDIS packet filter to NDIS_PACKET_TYPE_ALL_LOCAL. When you do this you will be able to monitor all packets directed to the local host and packets sent by the local host.

When an 802.11 adapter is operating in infrastructure mode the WLAN communication between the client and the access point (AP) is similar to connecting the client to a switch (instead of a hub). You simply can't see everything. Promiscuous mode simply doesn't make sense in this configuration.

As a result of this behavior, you can't develop a 802.11 WLAN network monitor using standard NDIS 5.X 802.11 miniport drivers.

There are vendors who DO provide 802.11 network monitors that work on Windows.

HOWEVER, they do NOT use standard 802.11 miniports. Instead, they work with SPECIFIC 802.11 NIC vendors and create a custom miniport driver that uses vendor-specific features of the hardware to sniff the ether. Their 802.11 network monitor application  communicates with their MODIFIED 802.11 miniport driver using a private interface to monitor the ether.

 

Topic Status
January 19, 2003 Information posted.
 

PCAUSA Home · Privacy Statement · Products · Ordering · Support · Utilities · Resources
Mailing Lists  · PCAUSA Newsletter · PCAUSA Discussion List
Rawether for Windows, Rawether .NET, WinDis 32 and NDIS Press are trademarks of Printing Communications Assoc., Inc. (PCAUSA)
Microsoft, MS, Windows, Windows Vista, Windows 95, Windows 98, Windows Millennium, Windows 2000, and Win32 are registered trademarks and Visual C++ and Windows NT are trademarks of the Microsoft Corporation.
Copyright © 1996-2009 Printing Communications Assoc., Inc. (PCAUSA)
Last modified: January 23, 2009