Network Security Tools

802.11 Monitor Mode

In 802.11 wireless networks you are generally interested in capturing all information on a particular frequency or channel, regardless of the network the traffic belongs to. Unfortunately, putting an 802.11 wireless card into promiscuous mode does not allow you to capture all packets on a channel; rather, it allows you to capture only the packets on the network you are attached to on that channel. To capture all packets on a channel, you need to put the card into a special mode known as monitor or rfmon mode.

Tip

Monitor mode is the mode for monitoring traffic, usually on a particular channel. A lot of wireless hardware is capable of entering monitor mode, but the ability to set the wireless hardware into monitor mode depends on support within the wireless driver. As such, you can force many cards into monitor mode in Linux, but in Windows you will probably need to write your own wireless network card driver.

Table 10-5 shows some ways to make common 802.11 wireless cards enter monitor mode. A good reference for cards capable of entering monitor mode is available from the web site for the Kismet tool, located at http://www.kismetwireless.net.

Table 10-5. Example commands to enter monitor mode

Driver/card	Operating system	Command
Cisco Aironet	Linux	Echo "mode: y" > '/proc/driver/aironet/<device>/Config'
HostAP	Linux	iwconfig <device> mode monitor
Orinoco (patched)	Linux	iwpriv <device> monitor 1 <channel>
Madwifi	Linux	iwconfig <device> mode ...