NIC Monitor Mode

ok maybe i shd explain in detail..

i am trying to sniff using my NIC.. initially i have a router in front of mi.. i sniffed nothing.. i also tried what u say.. putting the router aside and connect my modem to my PC directly.. but i onli sniffed ARP stuff.. if i wanna go further.. i can use nmap to test every single ip address.. but i just wanna sniff like a dog.. so is there any other ways to sniff.. btw i am using ethereal 0.9.. don tel mi a later version one can do what i wanna do..

ok based on the earlier.. i was thinking of siniffing a wireless traffic.. i just bought a DWL-G520+ card and installed into my XP box.. i have seen web sites like using Prism2 chipset card.. i don even know what is the chipset of my wi-fi card.. so how do i go about sniffing?

You sniff with a wi-fi card the same way you do with a regular ethernet card. As for the cable modem sniffing, maybe arp packets are the only traffic going on, the modem has some filtering abilitys or it's just not hooked up right.

OK... On your cable/DSL you are removed from the collision zone of the other users by the modem itself which is why you only see broadcast traffic. You would have to get outside your modem to be able to sniff anything that isn't for your computer.

The wireless card may or may not work to sniff depending upon whether it can be placed in promiscuous mode _and_ depending on whether there are others on the same WAP as you or have an ad-hoc network running between you and them. You need to research your card to discover whether it can even be placed into promiscuous mode. If it can't then forget it.

According to a quick search on google your Wi-fi card uses the Atheros chipset.

Quote:

---

According to a quick search on google your Wi-fi card uses the Atheros chipset.

---

Which is compatible with Netstumbler and all the other sniffing tools out there IIRC.

Quote:

---

Originally posted here by Tiger Shark
OK... On your cable/DSL you are removed from the collision zone of the other users by the modem itself which is why you only see broadcast traffic. You would have to get outside your modem to be able to sniff anything that isn't for your computer.

---

Are you sure that's completly true? I seem to recall hooking my laptop us straight to the modem and being able to see other traffic.

Iron: I have had several modems and all but the very first couple filter the traffic inbound. Also, are you sure the traffic wasn't destined for you from local machines..... You will pick up a lot of crap if you have skiddies in the neighborhood or if there is a major worm on the prowl.

Then again, I havn't tried sniffing my local subnet for a year or two... maybe something changed but it would have been a retro step which doesn't seem logical. I also read somewhere ages ago about how you could get onto certain modems and remove the filter but, just like uncapping your bandwidth, your ISP can detect it and will cut you off.....

I'll have to try again tonight. The data I remeber was not to or from my home LAN.

Quote:

---

I'll have to try again tonight. The data I remeber was not to or from my home LAN.

---

Kewl.... You can sniff the photos that hottie down the street is sending to her boyfriend.... ;)

I'm not 100% certain about this because it is a long time since I did it last but IIRC, I couldn't see anything except broadcast traffic on Comcast Cable. I have a hub outside my firewall that is there simply so that I can sniff packets that the firewall is dropping if I want to. I do remember years ago that I was able to see all the traffic but I believe they changed that a couple or more years ago..... Maybe it's just a localized thing.... I'll try it again when I get home.

I'm on Insight Cable, so they may not have the same policies.