NIC Monitor Mode

[Penguin]

Hi,

How can i make my NIC into monitor mode? so that i can sniff the network packets.

[Irongeek]

I think there term you are looking for is “Promiscuous mode” (unless you are talking Wi-Fi, in which RF monitoring mode means looking at the raw radio signals). Just about any sniffer should do it for you, I use Ethereal (http://www.ethereal.com/ ) and Ettercap (http://ettercap.sourceforge.net/).

[Tiger Shark]

While Irongeek is right I seem to remember you are a windows type so you will need WinPCap drivers.... Google WinPCap and it will be right there.

[Irongeek]

Good point, here is a link where you can get WinPCap from: http://winpcap.polito.it/

You might also want to look into using Cain: http://www.oxid.it/cain.html

[Penguin]

Originally posted here by Irongeek
I think there term you are looking for is “Promiscuous mode” (unless you are talking Wi-Fi, in which RF monitoring mode means looking at the raw radio signals). Just about any sniffer should do it for you, I use Ethereal (http://www.ethereal.com/ ) and Ettercap (http://ettercap.sourceforge.net/).

my suitable is that i have a router before me.. can i see those packet that is not for mi? or i just plug my pc directly to the modem? i have try ethereal.. cant see packets for others..

[Tiger Shark]

You'll never see packets that aren't in you collision zone.... You will only see packets that "pass by" your NIC....

[Irongeek]

As a quick answer, if you want to see the packets on you cable modem's segment you will have to connect your box with the sniffer directly to the modem.

[Penguin]

Originally posted here by Irongeek
As a quick answer, if you want to see the packets on you cable modem's segment you will have to connect your box with the sniffer directly to the modem.

how about in a wireless network? can i see other's packets too?

[Irongeek]

Expalin in detail what you are trying to do. You can use sniffers with Wi-Fi cards, but I though you wanted to sniff what was hitting your cable modem which is not going to work with a wi-fi card.

[Tiger Shark]

Penguin:

This is all really rather simple.... You have to be in the same collision zone as the packets you want to see are. Think of it like this:-

Bill has two ways to travel to work, Route 1 and Route 2. If you want to know which days Bill goes to work you have to watch one of the two routes, (you can't be in both places). So you pick route 1 and sit there every morning. If Bill goes along route 1 then you will see him, (you are in his collision zone), but if he takes route 2 you won't, (you are not in his collision zone).

You cannot see packets routed through collision zones that you do not have a sniffer on otherwise I could sniff packets from your computer to AO if I wanted. If I can get my sniffer onto the route between you and AO then I can because I have entered the same collision zone that you packets pass through....

Hoping that's clearer than mud.....