I was able to sniff the EAP packets from the attacker machine with a wireless card on p-mode, however i was not able to sniff this data off the user using the same card under windows. Wireshark, did not detect the card because it is external/USB. Microsoft network monitor in p-mode only shows the probe request and response, however i don't see the handshake between the attacker and the AP. does the Reaver attack hide its foot print so it can not be detected by sniffers ? i don't think so, if a packet is going to live air, it should be detected with a sniffer, right? is there specific things to account for?


You need low level access to the card/drivers in order to see that low level data. This is one of the reasons wireless tools have compatibility lists- do you can ensure you get a card which will provide you with the information you need.

  • I don't agree on the Windows side of things. A promiscuous mode device with supporting drivers, coupled with the pcap filter driver, will work fine. The same is required in Linux. WPS conversations occur over the same basic 802.11 frames as normal traffic. – Polynomial Apr 8 '13 at 7:12
  • Ok- windows can be worse – Rory Alsop Apr 8 '13 at 8:43
  • @poly - removed offending paragraph. – Rory Alsop Apr 8 '13 at 9:23

Windows does not allow creating RAW data packets. This is why nmap has so many issues with running on windows. Articles are all over the internet saying if your wanting to analyze traffic use a linux environment. Nice tool is kali linux @ http://kali.org free tools such as wireshark come prepackaged

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.