TABLE OF CONTENTS Unfortunately, Windows drivers for wireless cards do not normally include support for monitor mode access, instead restricting users to operating the card in managed mode. Fortunately, through a combination of commercial and open-source software, we can overcome this limitation to use Windows hosts for wireless traffic analysis with Wireshark.
In order to overcome the limitations with most wireless drivers for Windows systems, the engineers at CACE Technologies have introduced a commercial product called AirPcap. A combination of a USB IEEE 802.11b/g adapter, supporting driver software, and a client configuration utility, AirPcap provides a simple mechanism to capture wireless traffic in monitor mode on Windows workstations at a reasonable cost. AirPcap is available at www.cacetech.com.
After obtaining the AirPcap CD and USB wireless adapter, follow the installation instructions detailed in the AirPcap User s Guide. Ensure you have installed the appropriate version (WinPcap 4.0 beta 1) of WinPcap to support the AirPcap.
| Note | Unfortunately, at the time of this writing, there are no free software solutions that allow Windows users to capture wireless traffic reliably, and without violating other software license restrictions. If you need to perform wireless traffic analysis with a Windows workstation, Wireshark is an effective tool; however, you would have to purchase a driver and hardware combination that supports monitor mode. If you want to avoid any costs associated with drivers for monitor mode packet capture, you are encouraged to use a Linux option... |
