[Winpcap-bugs] Windows Vista Capture Problem

[Gianluca Varenni]

The problem is probably due to the fact that most of the wireless network card drivers fail to go into promiscuous mode. 

What I suspect you will see is that if you disable promiscuous mode, you will capture your own traffic only. If you enable promiscuous mode, you might possibly see NO traffic at all (this is a bug in WinPcap that has been fixed recently).

As specified in this FAQ

http://www.winpcap.org/misc/faq.htm#Q-16

support for capture over wireless networks in quite poor, mainly due to the limitations of the current wireless drivers (and windows itself).

Let me know if this answers your questions.

Have a nice day
GV
  ----- Original Message ----- 
  From: Kevin 
  To: winpcap-bugs at winpcap.org 
  Sent: Saturday, June 30, 2007 5:55 PM
  Subject: [Winpcap-bugs] Windows Vista Capture Problem


  Winpcap version: 4.0

  OS: Windows Vista Home Premium x86

  Windump ouput: see attached zip

  Network Adapters: Broadcom 802.11g network adapter, Marvel Yukon 88E8038 PCI-E Fast Ethernet Controller

  Special software / firewalls: none

  Problem Description: I'm using WinpCap 4.0 with Wireshark and I'm unable to capture packets in promiscuous mode using the Broadcom network adapter. I can see all my own traffic perfectly fine but the network traffic does not show up properly. All I see are ARP packets. I can't see any HTTP packets from the other machines on my network. My broadcom card shows up as Microsoft in wireshark but it shows the correct ip address. The Marvel Yukon adapter works perfectly fine even in promiscuious mode. I've tried other network cards atheros etc and all of them produce the same results. I thought it may be a driver issue but after trying different cards and drivers I changed my mind. I'm completly stumped. If you could look into this I would be very greatful. 

  Thank you for your time,

  Kevin


------------------------------------------------------------------------------


  _______________________________________________
  Winpcap-bugs mailing list
  Winpcap-bugs at winpcap.org
  https://www.winpcap.org/mailman/listinfo/winpcap-bugs
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-bugs/attachments/20070703/7e87a2ff/attachment.htm