Malformed packets at the 802.11 preamble level (due to interference, low signal or bad antenna position). Ex: a packet sent on channel 10 can be captured by monitor mode in channel 11 Packets of an adjacent channel can be heard. All bad FCS 802.11 packets are seen, as long as the 802.11 preamble is valid. All valid 802.11 packets heard by the radio on the frequency, encrypted or not. In monitoring mode: * Available media: Wireless * Connection state: Must be disassociated of any network, but configured with a specific channel & channel width (20 – 160MHz) * Lowest protocol seen: IEEE 802.11 * OSI model level: Physical (PHY) Layer + Data Link Layer (Mac) With or without promiscuous mode, Ethernet packet capture works with: * Available media: Wire / Wireless * Connection state: Wire: cable plugged (!) / Wireless: associated to an Access Point or ad-hoc network * Lowest protocol seen: Ethernet (IEEE 802.3) * OSI model level: Data Link Layer (Mac) * Packets seen: depends off the promiscuous mode * Packets not seen: Bad FCS packets: dropped by the network interface before the capture library can be aware of themĮncrypted 802.11n data packet captured in monitoring mode on Channel 116. Typically, Debookee NA module must put the interface in promiscuous mode to see intercepted packets from other devices like an iPhone because the destination MAC address is the iPhone’s one, not our own MAC address. 
In promiscuous mode: * All packets of non-promiscuous mode * Packets destined to another layer 2 network interface
In non-promiscuous mode, you’ll capture: * Packets destined to your network interface * Broadcasts * Multicasts So, you won’t see packets sent to another MAC address on your network if you sniff with a hub or a tap Ethernet at the top, after pseudo header “Frame” added by Wireshark
SIP packet captured in non-promiscuous mode.
0 kommentar(er)
