Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was able to sniff the EAP packets from the attacker machine with a wireless card on p-mode, however i was not able to sniff this data off the user using the same card under windows. Wireshark, did not detect the card because it is external/USB. Microsoft network monitor in p-mode only shows the probe request and response, however i don't see the handshake between the attacker and the AP. does the Reaver attack hide its foot print so it can not be detected by sniffers ? i don't think so, if a packet is going to live air, it should be detected with a sniffer, right? is there specific things to account for?

share|improve this question
add comment

2 Answers

Windows does not allow creating RAW data packets. This is why nmap has so many issues with running on windows. Articles are all over the internet saying if your wanting to analyze traffic use a linux environment. Nice tool is kali linux @ http://kali.org free tools such as wireshark come prepackaged

share|improve this answer
add comment

You need low level access to the card/drivers in order to see that low level data. This is one of the reasons wireless tools have compatibility lists- do you can ensure you get a card which will provide you with the information you need.

share|improve this answer
    
I don't agree on the Windows side of things. A promiscuous mode device with supporting drivers, coupled with the pcap filter driver, will work fine. The same is required in Linux. WPS conversations occur over the same basic 802.11 frames as normal traffic. –  Polynomial Apr 8 '13 at 7:12
    
Ok- windows can be worse –  Rory Alsop Apr 8 '13 at 8:43
    
@poly - removed offending paragraph. –  Rory Alsop Apr 8 '13 at 9:23
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.