<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2900.5726" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT size=2>What you are reading is the documentation for an NDIS 6.0
driver. WinPcap is still an NDIS 5.x one, so the </FONT><FONT
size=3>NDIS_PACKET_TYPE_802_11_xxxx filters are not usable from WinPcap. I don't
know exactly what the NDIS 5x <--> 6.0 thunking layer does when you set
the promiscuous mode, however.</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>GV</FONT></DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=haich.woo@gmail.com href="mailto:haich.woo@gmail.com">yu-ruei woo</A>
</DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A> </DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Monday, August 31, 2009 11:10
PM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> Re: [Winpcap-users] What does
WinPcap do when setting a 802.11wireless NIC into promiscuous mode?</DIV>
<DIV><FONT size=2></FONT><FONT size=2></FONT><FONT size=2></FONT><BR></DIV>Hi,
<DIV><FONT size=2></FONT><FONT size=2></FONT><FONT size=2></FONT><BR></DIV>
<DIV>After tracing the source code, I found that in PacketSetHwFilter,
you set the packet filter NDIS_PACKET_TYPE_PROMISCUOUS is true. Otherwise
the packet filter is set to NDIS_PACKET_TYPE_ALL_LOCAL.</DIV>
<DIV><FONT size=2></FONT><FONT size=2></FONT><FONT size=2></FONT><BR></DIV>
<DIV>In the WDK documentation, it says:</DIV>
<DIV>It is only valid for the miniport driver to enable the
NDIS_PACKET_TYPE_PROMISCUOUS, NDIS_PACKET_TYPE_802_11_PROMISCUOUS_MGMT, or
NDIS_PACKET_TYPE_802_11_PROMISCUOUS_CTRL packet filters if the driver is
operating in Network Monitor (NetMon) mode.<BR><BR></DIV>
<DIV>But in the source code, I can't find any request to the driver that sets
its operation mode to NetMon mode.</DIV>
<DIV><FONT size=2></FONT><FONT size=2></FONT><FONT size=2></FONT><FONT
size=2></FONT><BR></DIV>
<DIV>So I think setting promiscuous mode in WireShard will have to effect on
the NIC if the NIC driver follows the WDK documentation.</DIV>
<DIV><FONT size=2></FONT><FONT size=2></FONT><BR></DIV>
<DIV>Is that right?</DIV>
<DIV><BR></DIV>
<DIV>Best regards, </DIV>
<DIV>Haich</DIV>
<DIV><BR>
<DIV class=gmail_quote>On Tue, Sep 1, 2009 at 10:49 AM, yu-ruei woo <SPAN
dir=ltr><<A
href="mailto:haich.woo@gmail.com">haich.woo@gmail.com</A>></SPAN>
wrote:<BR>
<BLOCKQUOTE class=gmail_quote
style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid"><SPAN
style="FONT-SIZE: 16px; FONT-FAMILY: Arial; BORDER-COLLAPSE: collapse"><PRE style="WORD-WRAP: break-word">Hi,</PRE><PRE style="WORD-WRAP: break-word">I am recently modifying a WLAN driver such that it can receive 802.11 packets without filtering packets destined to other STA in the same BSS while keep the connection with the BSS. </PRE><PRE style="WORD-WRAP: break-word"><BR></PRE><PRE style="WORD-WRAP: break-word">I've tried the promiscuous mode, but I found that no OID is set to the WLAN driver to notify the driver that it should now operate in promiscuous mode.</PRE><PRE style="WORD-WRAP: break-word"><BR></PRE><PRE style="WORD-WRAP: break-word">I would like to know what does WinPcap do when setting a WLAN NIC into promiscuous receiving mode. Specifically, how does WinPcap notify the WLAN NIC that it should operate in promiscuous mode.</PRE><PRE style="WORD-WRAP: break-word"><BR></PRE><PRE style="WORD-WRAP: break-word">Best regards,</PRE><PRE style="WORD-WRAP: break-word">Haich</PRE></SPAN></BLOCKQUOTE></DIV><BR></DIV>
<P>
<HR>
<P></P>_______________________________________________<BR>Winpcap-users
mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users<BR></BLOCKQUOTE></BODY></HTML>