Wireshark-dev: Re: [Wireshark-dev] WLAN adapter which supports monitor mode ?

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 2 Dec 2008 02:24:28 -0800

On Nov 25, 2008, at 8:31 PM, Ru wrote:

Does anyone know a WLAN adapter which supports monitor mode in windows and hence capture linklayer nondataframes?

Some do, *if*:

	1) you're running on Vista (or perhaps 2008 Server)

*AND*

	2) you're using Microsoft Network Monitor 3.1 or later.

1) is because the Windows APIs necessary to put a WLAN adapter into monitor mode on Windows didn't exist until Vista.

2) is because WinPcap doesn't support those APIs.

Wireshark uses WinPcap, so it can't capture in monitor mode on those adapters.

The AirPcap adapters from CACE Technologies:

	http://www.cacetech.com/products/airpcap_family.htm

are, in effect, adapters that *ONLY* run in monitor mode - they can't be used as regular WLAN adapters, but they *can* capture traffic in monitor mode on Windows (they aren't supported on any other OSes).