NIC Monitor Mode
Page 1 of 3 123 LastLast
Results 1 to 10 of 26

Thread: NIC Monitor Mode

  1. #1
    Senior Member
    Join Date
    Dec 2002
    Posts
    144

    NIC Monitor Mode

    Hi,

    How can i make my NIC into monitor mode? so that i can sniff the network packets.
    BlAcKiE
    GearBlitz

  2. #2
    King Tutorial-ankhamun
    Join Date
    Jul 2004
    Posts
    897
    I think there term you are looking for is “Promiscuous mode” (unless you are talking Wi-Fi, in which RF monitoring mode means looking at the raw radio signals). Just about any sniffer should do it for you, I use Ethereal (http://www.ethereal.com/ ) and Ettercap (http://ettercap.sourceforge.net/).

  3. #3
    AO Ancient: Team Leader
    Join Date
    Oct 2002
    Posts
    5,197
    While Irongeek is right I seem to remember you are a windows type so you will need WinPCap drivers.... Google WinPCap and it will be right there.
    Don\'t SYN us.... We\'ll SYN you.....
    \"A nation that draws too broad a difference between its scholars and its warriors will have its thinking done by cowards, and its fighting done by fools.\" - Thucydides

  4. #4
    King Tutorial-ankhamun
    Join Date
    Jul 2004
    Posts
    897
    Good point, here is a link where you can get WinPCap from: http://winpcap.polito.it/

    You might also want to look into using Cain: http://www.oxid.it/cain.html

  5. #5
    Senior Member
    Join Date
    Dec 2002
    Posts
    144
    Originally posted here by Irongeek
    I think there term you are looking for is “Promiscuous mode” (unless you are talking Wi-Fi, in which RF monitoring mode means looking at the raw radio signals). Just about any sniffer should do it for you, I use Ethereal (http://www.ethereal.com/ ) and Ettercap (http://ettercap.sourceforge.net/).
    my suitable is that i have a router before me.. can i see those packet that is not for mi? or i just plug my pc directly to the modem? i have try ethereal.. cant see packets for others..
    BlAcKiE
    GearBlitz

  6. #6
    AO Ancient: Team Leader
    Join Date
    Oct 2002
    Posts
    5,197
    You'll never see packets that aren't in you collision zone.... You will only see packets that "pass by" your NIC....
    Don\'t SYN us.... We\'ll SYN you.....
    \"A nation that draws too broad a difference between its scholars and its warriors will have its thinking done by cowards, and its fighting done by fools.\" - Thucydides

  7. #7
    King Tutorial-ankhamun
    Join Date
    Jul 2004
    Posts
    897
    As a quick answer, if you want to see the packets on you cable modem's segment you will have to connect your box with the sniffer directly to the modem.

  8. #8
    Senior Member
    Join Date
    Dec 2002
    Posts
    144
    Originally posted here by Irongeek
    As a quick answer, if you want to see the packets on you cable modem's segment you will have to connect your box with the sniffer directly to the modem.
    how about in a wireless network? can i see other's packets too?
    BlAcKiE
    GearBlitz

  9. #9
    King Tutorial-ankhamun
    Join Date
    Jul 2004
    Posts
    897
    Expalin in detail what you are trying to do. You can use sniffers with Wi-Fi cards, but I though you wanted to sniff what was hitting your cable modem which is not going to work with a wi-fi card.

  10. #10
    AO Ancient: Team Leader
    Join Date
    Oct 2002
    Posts
    5,197
    Penguin:

    This is all really rather simple.... You have to be in the same collision zone as the packets you want to see are. Think of it like this:-

    Bill has two ways to travel to work, Route 1 and Route 2. If you want to know which days Bill goes to work you have to watch one of the two routes, (you can't be in both places). So you pick route 1 and sit there every morning. If Bill goes along route 1 then you will see him, (you are in his collision zone), but if he takes route 2 you won't, (you are not in his collision zone).

    You cannot see packets routed through collision zones that you do not have a sniffer on otherwise I could sniff packets from your computer to AO if I wanted. If I can get my sniffer onto the route between you and AO then I can because I have entered the same collision zone that you packets pass through....

    Hoping that's clearer than mud.....
    Don\'t SYN us.... We\'ll SYN you.....
    \"A nation that draws too broad a difference between its scholars and its warriors will have its thinking done by cowards, and its fighting done by fools.\" - Thucydides

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •