Marcello Mascheroni wrote:
Hi, I have a problem concernig a Centrino HP NC6000 with an Intel
Pro/Wireless LAN 2100 3B mini PCI Adapter (driver version 1.2.3.14) and
Windows
Yes - your problem is that you're running Windows and trying to use a
WinPcap-based application to capture traffic. Due to the way Windows
wireless drivers tend to work, promiscuous mode captures tend to be
completely worthless on wireless interfaces on Windows.
When we say, on the download page for the Windows version of Ethereal:
IMPORTANT NOTE ON 802.11
Ethereal's ability to capture traffic on 802.11 networks on Windows is
limited by the support offered by the Windows drivers for 802.11 adapters.
On Windows, you will not be able to capture management or control
frames, and you might not even be able to capture in promiscuous mode,
so you might only be able to capture traffic to and from the machine
running Ethereal.
If you want to use a PC running Ethereal to monitor 802.11 traffic to
or from other machines, rather than using Ethereal only to look at
traffic to and from the machine on which you're running Ethereal, you
should seriously consider running it on a recent version of Linux or of
one of the free-software BSDs, rather than on Windows. See the Ethereal
Wiki page on capture setup on WLANs for details on capturing 802.11
traffic in "monitor mode" on Linux and the free-software BSDs.
we're being *very* serious.
I installed first Wincap 3_1 Beta4 and then Ethereal 0.10.11.
The installation is OK but when I start to capture using in promiscouse
mode the Intel adapter (that is correctly recognised by Ethereal), I
don't see any packet (inbound nor outbound).
http://www.ethereal.com/faq.html#q5.39
I've also downloaded from your site the tool windump, and when I start
it, it says that *it is **listening on
\Device\NPF_GenericNdisWanAdapter* (I don't know if it's correct that is
listenig on a generic adapter and not on the Intel adapter...)
That's probably the default interface. You probably explicitly selected
the Intel adapter in Ethereal. However, if you explicitly select the
Intel adapter in WinDump (run "windump -D" to get a list of interfaces,
and then run WinDump with the "-i" option, specifying as an argument to
the option the number given for that interface in the output from
"windump -D" - that's 3, given the output you attached), you'll probably
get as little traffic as you do in Ethereal, as this isn't an Ethereal
or WinDump problem - it's not even a WinPcap problem, it's a problem
with Windows wireless adapter drivers.
*PS: I've checked that the version of the driver is supported form wincap.*
Which driver? The wireless driver? That just means that the system
won't explode if you try to capture on it; there's no guarantee that it
works in promiscuous mode, for example.
