<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2900.5726" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT size=2></FONT> </DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=haich.woo@gmail.com href="mailto:haich.woo@gmail.com">yu-ruei woo</A>
</DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A> </DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Monday, September 14, 2009 1:21
AM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> Re: [Winpcap-users] What does
WinPcap do when setting a802.11wireless NIC into promiscuous mode?</DIV>
<DIV><FONT size=2></FONT><FONT size=2></FONT><BR></DIV>Hi,
<DIV><FONT size=2></FONT><FONT size=2></FONT><BR></DIV>
<DIV>I've checked that OID_GEN_CURRENT_PACKET_FILTER is supported in
NDIS5 and NDIS_PACKET_TYPE_PROMISCUOUS an available filter. So it should
be OK to let WinPcap put my WLAN NIC in promiscuous mode on Windows
XP.</DIV><FONT size=2></FONT><FONT size=2></FONT></BLOCKQUOTE>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV>But when I configure the WLAN NIC into promiscuous mode (using WireShark)
and press start, a dialog pops up with error message: The capture session
could not be initiated (failed to set hardware filter to promiscuous
mode).</DIV><FONT size=2></FONT><FONT size=2></FONT></BLOCKQUOTE>
<DIV><FONT size=2>This is because WinPcap tries to set the current packet filter
to NDIS_PACKET_TYPE_PROMISCUOUS, but the underlying miniport controlling your
wireless card fails the request. There is nothing that WinPcap can do for
that.</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>Does it make any sense to you?</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>Have a nice day</FONT></DIV>
<DIV><FONT size=2>GV</FONT></DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><BR></DIV>
<DIV>Would you give me a suggestion?</DIV>
<DIV><BR></DIV>
<DIV>Thanks.</DIV>
<DIV>Haich</DIV>
<DIV><BR><BR>
<DIV class=gmail_quote>On Tue, Sep 1, 2009 at 11:14 PM, Gianluca Varenni <SPAN
dir=ltr><<A href="mailto:gianluca.varenni@cacetech.com"
target=_blank>gianluca.varenni@cacetech.com</A>></SPAN> wrote:<BR>
<BLOCKQUOTE class=gmail_quote
style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">
<DIV bgcolor="#ffffff">
<DIV><FONT size=2>What you are reading is the documentation for an NDIS 6.0
driver. WinPcap is still an NDIS 5.x one, so the </FONT><FONT
size=3>NDIS_PACKET_TYPE_802_11_xxxx filters are not usable from WinPcap. I
don't know exactly what the NDIS 5x <--> 6.0 thunking layer does when
you set the promiscuous mode, however.</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>GV</FONT></DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV>
<DIV></DIV>
<DIV>
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV style="BACKGROUND: #e4e4e4; FONT: 10pt arial"><B>From:</B> <A
title=haich.woo@gmail.com href="mailto:haich.woo@gmail.com"
target=_blank>yu-ruei woo</A> </DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A
title=winpcap-users@winpcap.org href="mailto:winpcap-users@winpcap.org"
target=_blank>winpcap-users@winpcap.org</A> </DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Monday, August 31, 2009 11:10
PM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> Re: [Winpcap-users] What
does WinPcap do when setting a 802.11wireless NIC into promiscuous
mode?</DIV>
<DIV><FONT size=2></FONT><FONT size=2></FONT><FONT
size=2></FONT><BR></DIV>Hi,
<DIV><FONT size=2></FONT><FONT size=2></FONT><FONT
size=2></FONT><BR></DIV>
<DIV>After tracing the source code, I found that
in PacketSetHwFilter, you set the packet
filter NDIS_PACKET_TYPE_PROMISCUOUS is true. Otherwise the packet
filter is set to NDIS_PACKET_TYPE_ALL_LOCAL.</DIV>
<DIV><FONT size=2></FONT><FONT size=2></FONT><FONT
size=2></FONT><BR></DIV>
<DIV>In the WDK documentation, it says:</DIV>
<DIV>It is only valid for the miniport driver to enable the
NDIS_PACKET_TYPE_PROMISCUOUS, NDIS_PACKET_TYPE_802_11_PROMISCUOUS_MGMT, or
NDIS_PACKET_TYPE_802_11_PROMISCUOUS_CTRL packet filters if the driver is
operating in Network Monitor (NetMon) mode.<BR><BR></DIV>
<DIV>But in the source code, I can't find any request to the driver that
sets its operation mode to NetMon mode.</DIV>
<DIV><FONT size=2></FONT><FONT size=2></FONT><FONT size=2></FONT><FONT
size=2></FONT><BR></DIV>
<DIV>So I think setting promiscuous mode in WireShard will have to effect
on the NIC if the NIC driver follows the WDK documentation.</DIV>
<DIV><FONT size=2></FONT><FONT size=2></FONT><BR></DIV>
<DIV>Is that right?</DIV>
<DIV><BR></DIV>
<DIV>Best regards, </DIV>
<DIV>Haich</DIV>
<DIV><FONT size=2></FONT><BR>
<DIV class=gmail_quote>On Tue, Sep 1, 2009 at 10:49 AM, yu-ruei woo <SPAN
dir=ltr><<A href="mailto:haich.woo@gmail.com"
target=_blank>haich.woo@gmail.com</A>></SPAN> wrote:<BR>
<BLOCKQUOTE class=gmail_quote
style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid"><SPAN
style="FONT-SIZE: 16px; FONT-FAMILY: Arial; BORDER-COLLAPSE: collapse"><PRE style="WORD-WRAP: break-word">Hi,</PRE><PRE style="WORD-WRAP: break-word">I am recently modifying a WLAN driver such that it can receive 802.11 packets without filtering packets destined to other STA in the same BSS while keep the connection with the BSS. </PRE><PRE style="WORD-WRAP: break-word"><BR></PRE><PRE style="WORD-WRAP: break-word">I've tried the promiscuous mode, but I found that no OID is set to the WLAN driver to notify the driver that it should now operate in promiscuous mode.</PRE><PRE style="WORD-WRAP: break-word"><BR></PRE><PRE style="WORD-WRAP: break-word">I would like to know what does WinPcap do when setting a WLAN NIC into promiscuous receiving mode. Specifically, how does WinPcap notify the WLAN NIC that it should operate in promiscuous mode.</PRE><PRE style="WORD-WRAP: break-word"><BR></PRE><PRE style="WORD-WRAP: break-word">Best regards,</PRE><PRE style="WORD-WRAP: break-word">Haich</PRE></SPAN></BLOCKQUOTE></DIV><BR></DIV></DIV></DIV>
<P></P>
<HR>
<P></P>_______________________________________________<BR>Winpcap-users
mailing list<BR><A href="mailto:Winpcap-users@winpcap.org"
target=_blank>Winpcap-users@winpcap.org</A><BR><A
href="https://www.winpcap.org/mailman/listinfo/winpcap-users"
target=_blank>https://www.winpcap.org/mailman/listinfo/winpcap-users</A><BR>
<P></P></BLOCKQUOTE></DIV><BR>_______________________________________________<BR>Winpcap-users
mailing list<BR><A href="mailto:Winpcap-users@winpcap.org"
target=_blank>Winpcap-users@winpcap.org</A><BR><A
href="https://www.winpcap.org/mailman/listinfo/winpcap-users"
target=_blank>https://www.winpcap.org/mailman/listinfo/winpcap-users</A><BR><BR></BLOCKQUOTE></DIV><BR></DIV>
<P>
<HR>
<P></P>_______________________________________________<BR>Winpcap-users
mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users<BR></BLOCKQUOTE></BODY></HTML>