On Dec 5, 2007 2:41 PM, hce <webmail.hce@xxxxxxxxx> wrote:
>
> On Dec 5, 2007 1:57 PM, Guy Harris <guy@xxxxxxxxxxxx> wrote:
> > hce wrote:
> >
> > > Does wireshark-0.99.6 include wifi 802.11 capture?
> >
> > Wireshark, by default, includes support for capturing packets using
> > libpcap on UN*X and WinPcap on Windows. Whether it can capture 802.11
> > packets depends on libpcap, and the underlying packet capture mechanism
> > it uses, on UN*X, and on WinPcap on Windows.
My applology, the wireshark-0.99.6 is running on linux FC6. And it is
just capturing wifi data on its wifi port (will be required to capture
all other traffic as well).
> > Whether libpcap, and the underlying packet capture mechanism it uses, or
> > WinPcap, can capture 802.11 packets - and whether, when you capture
> > those packets, you get packets with 802.11 headers, possibly including
> > management and control packets as well as data packets, or you get data
> > packets with Ethernet headers - depends on the OS on which you're
> > capturing, the device on which you're capturing, and the configuration
> > you've done.
The libpcap version I used is libpcap-0.9.4-11.fc6.i386.rpm. How can I
check whether this version supports 802.11 or not?
I configured with Link-layer header type: Ethernet (it can only select
either Ethnernet or Data Over Cable Service Interface) and with
Capture packets in promiscuous mode (I tried to turn promiscuous mode
off, not work either). The frame only include IEEE 802.3 Ethnernet.
> > See
> >
> > http://www.wireshark.org/faq.html#q8.7
> >
> > http://www.wireshark.org/faq.html#q8.8
> >
> > http://www.wireshark.org/faq.html#sec10
> >
> > http://wiki.wireshark.org/CaptureSetup/WLAN
> >
> > for more details.
I checked to the document, it says "This would probably require that
you capture in promiscuous mode or in the mode called "monitor mode"
or "RFMON mode". Where can I found monitor mode or RFMON mode in
Capture Option?
Thank you.
Kind Regards,
Jim