Wireshark-dev: Re: [Wireshark-dev] How Wireshark supports monitor mode for WLAN 802.11 adapter
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 30 Dec 2015 13:04:04 -0800
On Dec 30, 2015, at 12:14 PM, Guy Harris <guy@xxxxxxxxxxxx> wrote:

> On Dec 29, 2015, at 11:29 PM, Yang Luo <hsluoyb@xxxxxxxxx> wrote:
> 
>> I changed this function to always returning 1, which means "supported". I know here I should check whether the adapter supports the monitor mode, but I found no way to check. All I can do is to get/set the current mode using the OID way above.
> 
> That might be the only way

Or not.

The OID_DOT11_OPERATION_MODE_CAPABILITY OID:

	https://msdn.microsoft.com/en-us/library/windows/hardware/ff569396(v=vs.85).aspx

returns a structure with a uOpModeCapability field; the adapter supports it if and only if the DOT11_OPERATION_MODE_NETWORK_MONITOR flag bit is set in that field.  So you'll have to open the device in order to get that OID, but it'll at least tell you whether the device supports it.  If the OID isn't supported, or if it is but DOT11_OPERATION_MODE_NETWORK_MONITOR isn't set, the device doesn't support monitor mode, otherwise it does.