[Ethereal-users] RE: WLAN cards and Ethereal

["Terje Trane" <trane@xxxxxxxxx>]

I spoke to a tech consultant at Sniffer Technologies (a Network Associoates
company) yesterday, they have a product-line called Sniffer based on NetXray
and some DOS sniffer that I have forgotten the name of. They have now a
product called SnifferPro Wireless that can be used to see the traffic "in
the air".

According to him they have to write their own drivers for WLAN-cards since
none of them have promiscous mode capabilities. The have written drivers for
Cisco Aironet and Symbol, and drivers to Lucent are coming. Maybe it is
possible to get it separatly, I didn't ask (though I fear they will prefer
not to enable others to compete with their product).

Maybe we can contact Lucent/Agere and ask them to make it.
Maybe someone is capable of writing a new driver.
Maybe switch to Linux?
From:
http://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/Linux.Wireless.drivers.
html

Driver name :  wvlan_cs.o
Other features :  MTU selection, multicast, promiscuous mode, power
management, WEP hardware encryption, SMP, multi-firmware and PPC support.
License :  GPL

I Cc-ed to ethereal-users since this might be of interest to others.



--
Terje



-----Original Message-----
From: maynard [mailto:maynard@xxxxxxxxxxxxxx]
Sent: 6. september 2001 10:10
To: trane@xxxxxxxxx
Subject: re: WLAN cards and Ethereal


I noticed your post on ethereal-users when I was scanning the archives, I
have the exact same problem (can only see outgoing traffic using an
orinoco card and linksys access point). However - I did notice some MAC
addresses in the capture, and discovered that all the incomming traffic to
the card was on the LLC protocol. ie my access point is not using tcp to
talk to the card (kinda freaky) - it uses this link layer protocol to talk
wirelessly (i tested this on another machine that i have hooked up with a
wire to my access point, and I was able to see both incomming and outgoing
on that machine)....

so... my current feeling is, not only can we not set the orinoco cards to
promiscuous, we cannot even see incomming tcp streams because, in effect,
there aren't any.

bummer....  let me know if you have discovered any differently. I heard
somewhere that the cisco cards can be set to promiscuous...  but I dont
have one to test - and that still might not solve our particular problem

Jordan Maynard
jmaynard@xxxxxx
maynard@xxxxxxxxxxxxxx