On Nov 25, 2008, at 8:31 PM, Ru wrote:
Does anyone know a WLAN adapter which supports monitor mode in
windows and hence capture linklayer nondataframes?
Some do, *if*:
1) you're running on Vista (or perhaps 2008 Server)
*AND*
2) you're using Microsoft Network Monitor 3.1 or later.
1) is because the Windows APIs necessary to put a WLAN adapter into
monitor mode on Windows didn't exist until Vista.
2) is because WinPcap doesn't support those APIs.
Wireshark uses WinPcap, so it can't capture in monitor mode on those
adapters.
The AirPcap adapters from CACE Technologies:
http://www.cacetech.com/products/airpcap_family.htm
are, in effect, adapters that *ONLY* run in monitor mode - they can't
be used as regular WLAN adapters, but they *can* capture traffic in
monitor mode on Windows (they aren't supported on any other OSes).