Ethereal-users: Re: [Ethereal-users] Ethereal in Win2K

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxx>
Date: Wed, 28 Nov 2001 14:35:30 -0800 (PST)
> I had this idea, first, install and run airopeek, this will set the WLAN
> card into listen mode (and hopefully Promiscuous mode - airopeek demo
> version was happily showing me all the beacon signals it picked up on my
> card and thus the prom mode shld be working as advertised). THEN run
> Ethereal in the background and use it like normal.
> 
> I have tried out the procedure I have described above but could not get
> Ethereal to pick up any packets other then those to or from my own card.
> However, the airopeek proggie running in the back could pick up lots of
> other things. 
> 
> I am not sure what I did wrong.

Well, one thing you might have done wrong is assume that the driver that
comes with Airopeek supports the standard Windows NDIS mechanism for
promiscuous mode, so that when Airopeek turns promiscuous mode on, any
NDIS connection that's specified NDIS_PACKET_TYPE_PROMISCUOUS will see
the promiscuously-received packets.

That might not be the case.  They may well use their own special
mechanism for running the card in promiscuous mode and getting all the
packets it sees, and they may not support NDIS_PACKET_TYPE_PROMISCUOUS. 
(I.e., it may put the *card* into promiscuous mode, but it may not show
the promiscuously-received packets to anything other than Airopeek.)

If so, Ethereal is not going to be helped by the Airopeek driver, even
if Airopeek happens to be running at the time that Ethereal is running.