["rupesh gautam" <csd01428_1@xxxxxxxxxxxxxx>]

 
Thanx for quick reply....

I have captured data in promiscuous mode ( airnonet card with fedora )
but i am unable to recognize packets between wired ethernet and
wireless(because ethreal captures data from both wired and wireless in promiscuous mode)....

how can we recognize that??? in my data ethereal shows only Ethernet II type........

what is this Ethernet II type...is it 802.3 or 802.11.............


thanx


On Sun, 03 Apr 2005 Guy Harris wrote :
>rupesh gautam wrote:
>
>>i am newbie..i want to ask that whether promiscuous mode is different than rfmon mode or not
>
>As far as I know, yes.  As I understand it, from what I've heard, in promiscuous mode, an adapter will see only packets in the BSS with which it's associated, whereas, in monitor/rfmon mode, it'll see all packets on the radio channel it's listening to.
>
>>....can we capture 802.11 data in promiscuous mode
>
>Yes, but you might only be able to capture data frames, not management or control frames, depending on the driver.  (In "host AP" mode, if an adapter and driver support it, management frames are presumably passed to the host, so you might be able to capture those packets even if you're not in rfmon mode.  I don't know whether any drivers that support "host AP" mode do that, however.)
>
>>..i am using cisco 350 wireless card.....
>
>On what operating system?
>
>I don't know which OSes have Aironet drivers that support "host AP" mode, if any - I don't even know whether the Aironet cards support "host AP" mode, although if Cisco uses them in their AP's, the cards presumably do - so you might not be able to capture management frames in promiscuous mode.
>
>I think all Linux and BSD Aironet drivers support promiscuous mode.  The Linux and FreeBSD ones support rfmon mode.  I don't know whether the Windows one supports promiscuous mode at all.