Monitor mode

Monitor mode

Monitor mode, or RFMON (Radio Frequency MONitor) mode, allows a computer with a wireless network interface controller (NIC) to monitor all traffic received from the wireless network. Unlike promiscuous mode, which is also used for packet sniffing, monitor mode allows packets to be captured without having to associate with an access point or ad-hoc network first. Monitor mode only applies to wireless networks, while promiscuous mode can be used on both wired and wireless networks. Monitor mode is one of the six modes that 802.11 wireless cards can operate in: Master (acting as an access point), Managed (client, also known as station), Ad-hoc, Mesh, Repeater, and Monitor mode.

Contents

Uses

Monitor mode may be used for malicious purposes, such as collecting traffic for WEP cracking. It may also be used for legitimate purposes such as monitoring one's own network to ensure its terms of use are being followed. This mode is also somewhat useful during the design phase of Wi-Fi network construction to discover how many Wi-Fi devices are already using spectrum in a given area and how busy various Wi-Fi channels are in that area. This helps to plan the Wi-Fi network better and reduce interference with other Wi-Fi devices by choosing the least used channels for a new Wi-Fi network.

Software such as KisMAC or Kismet, in combination with packet analyzers that can read pcap files, provide a user interface for passive wireless network monitoring.

Limitations

Usually the wireless adapter is unable to transmit in monitor mode and is restricted to a single wireless channel, though this is dependent on the wireless adapter's driver, its firmware, and its chip set's features. Also, in monitor mode the adapter does not check to see if the cyclic redundancy check (CRC) values are correct for packets captured, so some captured packets may be corrupted.

Operating system support

The Microsoft Windows Network Driver Interface Specification (NDIS) API does not support any extensions for wireless monitor mode in older versions of Windows. With NDIS 6, available in Windows Vista and later versions of Windows, it is possible to enable monitor mode.[1] NDIS 6 supports exposing 802.11 frames to the upper protocol levels;[2] with previous versions of NDIS only fake Ethernet frames translated from the 802.11 data frames can be exposed to the upper protocol levels.

For versions of Windows prior to Windows Vista, some packet analyzer applications such as Wildpackets' OmniPeek provide their own device drivers to support monitor mode.

Linux's interfaces for 802.11 drivers support monitor mode and many drivers offer that support.[3] FreeBSD, NetBSD, OpenBSD, and DragonFly BSD also provide an interface for 802.11 drivers that supports monitor mode, and many drivers for those operating systems support monitor mode as well. In Mac OS X 10.4 and later releases, the drivers for AirPort Extreme network adapters allow the adapter to be put into monitor mode. Libpcap 1.0.0 and later provides an API to select monitor mode when capturing on those operating systems.

See also

References

  1. ^ "Network Monitor Operation Mode". Windows Driver Kit: Network Devices and Protocols. Microsoft. http://msdn2.microsoft.com/en-us/library/aa503132.aspx. Retrieved 2007-11-30. 
  2. ^ "Indicating Raw 802.11 Packets". Windows Driver Kit: Network Devices and Protocols. Microsoft. http://msdn2.microsoft.com/en-us/library/aa503359.aspx. Retrieved 2007-11-30. 
  3. ^ Aircrack/Aireplay-ng Under Packet Injection Monitor Mode in Windows retrieved September 11, 2007

External links


Wikimedia Foundation. 2010.

Игры ⚽ Нужно решить контрольную?

Look at other dictionaries:

  • Monitor Mode — oder Monitormodus bezeichnet einen bestimmten Betriebsmodus eines Wireless Adapters, bei dem sämtliche empfangenen Netzwerkframes an das Betriebssystem und die Anwendungen weitergeleitet werden. Im Monitor Mode werden im Gegensatz zum Promiscuous …   Deutsch Wikipedia

  • Mode moniteur — Pour les articles homonymes, voir Mode moniteur (homonymie). Le mode moniteur (aussi appelé Radio Frequency Monitoring, RF Monitor, rfmon, RFMON, Air Monitor, Network Monitor, NetMon, ou encore surveillance RF) permet à un ordinateur équipé d une …   Wikipédia en Français

  • Mode X — is an alternative video graphics display mode of the IBM VGA graphics hardware that was popularized by Michael Abrash, first published in July 1991 in Dr. Dobb s Journal, republished in chapters 47 49 of Abrash s Graphics Programming Black Book… …   Wikipedia

  • mode — W3 [məud US moud] n [Date: 1300 1400; : Latin; Origin: modus measure, way ] 1.) formal a particular way or style of behaving, living or doing something mode of ▪ the most efficient mode of transport ▪ They have a relaxed mode of life that suits… …   Dictionary of contemporary English

  • Air Monitor — Mode moniteur Pour les articles homonymes, voir Mode moniteur (homonymie). Le mode moniteur (aussi appelé Radio Frequency Monitoring, RF Monitor, rfmon, RFMON, Air Monitor, Network Monitor, NetMon, ou encore surveillance RF) permet à un… …   Wikipédia en Français

  • Air monitor — Mode moniteur Pour les articles homonymes, voir Mode moniteur (homonymie). Le mode moniteur (aussi appelé Radio Frequency Monitoring, RF Monitor, rfmon, RFMON, Air Monitor, Network Monitor, NetMon, ou encore surveillance RF) permet à un… …   Wikipédia en Français

  • Network Monitor — Mode moniteur Pour les articles homonymes, voir Mode moniteur (homonymie). Le mode moniteur (aussi appelé Radio Frequency Monitoring, RF Monitor, rfmon, RFMON, Air Monitor, Network Monitor, NetMon, ou encore surveillance RF) permet à un… …   Wikipédia en Français

  • RF Monitor — Mode moniteur Pour les articles homonymes, voir Mode moniteur (homonymie). Le mode moniteur (aussi appelé Radio Frequency Monitoring, RF Monitor, rfmon, RFMON, Air Monitor, Network Monitor, NetMon, ou encore surveillance RF) permet à un… …   Wikipédia en Français

  • Mode moniteur (homonymie) — Cette page d’homonymie répertorie les différents sujets et articles partageant un même nom. Le mode moniteur permet d écouter de tout le trafic d un réseau sans fil sur une carte ou un point d accès Wi Fi Le mode moniteur, aussi appelé mode noyau …   Wikipédia en Français

  • Multi-monitor — Multi Monitor, also called Multi Display and Multi Head, is the use of multiple physical display devices, such as monitors, televisions, and projectors, in order to increase the area available for computer programs running on a single computer… …   Wikipedia

Share the article and excerpts

Direct link
Do a right-click on the link above
and select “Copy Link”