Wireshark · Wireshark-dev: Re: [Wireshark-dev] How Wireshark supports monitor mode for WLAN 802.11 adapter in Windows?

[Yang Luo <hsluoyb@xxxxxxxxx>]

Hi Alexis,

So it seems that I need to build Wireshark from source. I encountered some errors when building:

My build machine is Win10 x64. I am using the trunk code of Wireshark (git clone https://code.wireshark.org/review/wireshark), VS 2013 Ultimate, QT 5.5.1 for MSVC 2013 64bit, CMake 3.4.1 and latest cygwin64. I followed the guide here: https://www.wireshark.org/docs/wsdg_html_chunked/ChSetupCMake.html#ChWin32Build

The code is stored here:

J:\github_repos\wireshark

My commands are:

set CYGWIN=nodosfilewarning

set WIRESHARK_BASE_DIR=J:\github_repos

set WIRESHARK_TARGET_PLATFORM=win64

set QT5_BASE_DIR=C:\Qt\Qt5.5.1\5.5\msvc2013_64

set WIRESHARK_VERSION_EXTRA=-MonitorEnabled

set WIRESHARK_CYGWIN_INSTALL_PATH=c:\cygwin64

mkdir J:\github_repos\wsbuild64

cd J:\github_repos\wsbuild64

cmake -DENABLE_CHM_GUIDES=on -G "Visual Studio 12 2013 Win64" ..\wireshark

msbuild /m /p:Configuration=RelWithDebInfo Wireshark.sln

And I encountered many errors like below, how to fix these errors? The entire build log is in the attachment.

    74>C:\Program Files (x86)\MSBuild\Microsoft.Cpp\v4.0\V120\Microsoft.CppCommon.targets(170,5): error MSB6006: "cmd.e

       xe" exited with code 9009. [J:\github_repos\wsbuild64\docbook\developer_guide_docbook.vcxproj]

    91>J:\github_repos\wireshark-win64-libs\gtk2\include\glib-2.0\gobject/gsignal.h : error C2220: warning treated as e

       rror - no 'object' file generated (J:\github_repos\wireshark\ui\gtk\about_dlg.c) [J:\github_repos\wsbuild64\ui\g

       tk\gtkui.vcxproj]

    91>J:\github_repos\wireshark-win64-libs\gtk2\include\glib-2.0\gobject/gsignal.h : error C2220: warning treated as e

       rror - no 'object' file generated (J:\github_repos\wireshark\ui\gtk\addr_resolution_dlg.c) [J:\github_repos\wsbu

       ild64\ui\gtk\gtkui.vcxproj]

         capture_if_dlg.c

         capture_info_dlg.c

         color_dlg.c

    91>J:\github_repos\wireshark-win64-libs\gtk2\include\glib-2.0\gobject/gsignal.h : warning C4819: The file contains

       a character that cannot be represented in the current code page (936). Save the file in Unicode format to preven

       t data loss (J:\github_repos\wireshark\ui\gtk\about_dlg.c) [J:\github_repos\wsbuild64\ui\gtk\gtkui.vcxproj]

    91>J:\github_repos\wireshark-win64-libs\gtk2\include\glib-2.0\gobject/gsignal.h : warning C4819: The file contains

       a character that cannot be represented in the current code page (936). Save the file in Unicode format to preven

       t data loss (J:\github_repos\wireshark\ui\gtk\addr_resolution_dlg.c) [J:\github_repos\wsbuild64\ui\gtk\gtkui.vcx

       proj]

    91>J:\github_repos\wireshark-win64-libs\gtk2\include\glib-2.0\gobject/gsignal.h : error C2220: warning treated as e

       rror - no 'object' file generated (J:\github_repos\wireshark\ui\gtk\bytes_view.c) [J:\github_repos\wsbuild64\ui\

       gtk\gtkui.vcxproj]

    91>J:\github_repos\wireshark-win64-libs\gtk2\include\glib-2.0\gobject/gsignal.h : error C2220: warning treated as e

       rror - no 'object' file generated (J:\github_repos\wireshark\ui\gtk\capture_dlg.c) [J:\github_repos\wsbuild64\ui

       \gtk\gtkui.vcxproj]

    91>J:\github_repos\wireshark-win64-libs\gtk2\include\glib-2.0\gobject/gsignal.h : error C2220: warning treated as e

       rror - no 'object' file generated (J:\github_repos\wireshark\ui\gtk\capture_file_dlg.c) [J:\github_repos\wsbuild

       64\ui\gtk\gtkui.vcxproj]

    91>J:\github_repos\wireshark-win64-libs\gtk2\include\glib-2.0\gobject/gsignal.h : error C2220: warning treated as e

       rror - no 'object' file generated (J:\github_repos\wireshark\ui\gtk\color_dlg.c) [J:\github_repos\wsbuild64\ui\g

       tk\gtkui.vcxproj]

    91>J:\github_repos\wireshark-win64-libs\gtk2\include\glib-2.0\gobject/gsignal.h : error C2220: warning treated as e

       rror - no 'object' file generated (J:\github_repos\wireshark\ui\gtk\capture_info_dlg.c) [J:\github_repos\wsbuild

       64\ui\gtk\gtkui.vcxproj]

Cheers,

Yang

On Wed, Dec 30, 2015 at 9:38 PM, Alexis La Goutte <alexis.lagoutte@xxxxxxxxx> wrote:

Hi Yang,

Good idea ! (i like)

There is a "Monitor" column on Wireshark but need to have SHOW_MONITOR_COLUMN (HAVE_PCAP_CREATE) enable (see ui/qt/capture_interfaces_dialog.cpp )

But the column will look no available on Windows...

Cheers

On Wed, Dec 30, 2015 at 8:29 AM, Yang Luo <hsluoyb@xxxxxxxxx> wrote:

Hi list,

I am considering adding native 802.11 packet capturing support (including management and control frames) in Npcap. This is possible because Microsoft Network Monitor already implements this feature for Vista and later. 

To enable these packets' capturing, we need to switch on the Wi-Fi adapter's monitor mode. With the help of Guy (http://stackoverflow.com/questions/34507789/how-to-enable-802-11-monitor-mode-dot11-operation-mode-network-monitor-in-a-nd), I know some stuffs about it. In NDIS side, there's an OID called OID_DOT11_CURRENT_OPERATION_MODE to set and get the current operation mode of the adapter. Possible values are DOT11_OPERATION_MODE_NETWORK_MONITOR (monitor mode) and DOT11_OPERATION_MODE_EXTENSIBLE_STATION (non-monitor mode). There's no way to check whether an adapter supports monitor mode or not.

In Npcap's libpcap/wpcap part, I have added the monitor mode support by changing two places, I don't know if this is the right way:

1) pcap_activate_win32 function in \wpcap\libpcap\pcap-win32.c:

https://github.com/nmap/npcap/blob/master/wpcap/libpcap/pcap-win32.c

Line 569

if (p->opt.rfmon) {

/*

* No monitor mode on Windows XP and earlier.  It could be done on

* Vista with drivers that support the native 802.11

* mechanism and monitor mode.

*/

DOT11_CURRENT_OPERATION_MODE operation_mode;

operation_mode.uCurrentOpMode = DOT11_OPERATION_MODE_NETWORK_MONITOR;

if (pcap_oid_set_request_win32(p, OID_DOT11_CURRENT_OPERATION_MODE, &operation_mode, sizeof(DOT11_CURRENT_OPERATION_MODE)) != 0)

return (PCAP_ERROR_RFMON_NOTSUP);

}

So instead of originally return (PCAP_ERROR_RFMON_NOTSUP);, this code will set the monitor mode of the adapter.

2) pcap_cant_set_rfmon function in wpcap\libpcap\pcap.c:

https://github.com/nmap/npcap/blob/master/wpcap/libpcap/pcap.c

Line 98

/*

 * For systems where rfmon mode is never supported.

 */

static int

pcap_cant_set_rfmon(pcap_t *p _U_)

{

return (1);

// return (0);

}

I changed this function to always returning 1, which means "supported". I know here I should check whether the adapter supports the monitor mode, but I found no way to check. All I can do is to get/set the current mode using the OID way above.

After all these changes, there's no change in Wireshark, I didn't find a place to switch on/off the monitor mode like Microsoft Network Monitor. So I doubt whether Wireshark supports the monitor mode of Wlan in Windows? And how Wireshark UI make use of the monitor mode? Thanks.

Cheers,

Yang

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives:    https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives:    https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe