Intel 5100 promiscuous mode

chickenlinux · 09-21-2009, 12:52 PM

Hello! I was wondering if anyone knows (and/or how I can find out) if an intel 5100 agn card supports promiscuous mode. If so, I would like to know how to set it up so it will promiscuously capture.

I'm using fedora 11 with a 2.6.30-something kernel.

Here's the relevant portion of lspci:

Code:

03:00.0 Network controller: Intel Corporation PRO/Wireless 5100 AGN [Shiloh] Network Connection

I'm on a Thinkpad T400. Any help would be appreciated.
I've used iw to make a virtual monitor interface, but if I capture in wireshark, I don't really want a bunch of confusing IEEE raw mystery packets.

ANY help is, well, helpful

kbp · 09-23-2009, 12:43 AM

Howdy,

Try:

Code:

sudo /sbin/ifconfig ethX promisc

then:

Code:

sudo /sbin/ifconfig ethX

and look for:

Code:

...
UP BROADCAST PROMISC MULTICAST  MTU:1500  Metric:1
...

Then turn it off with:

Code:

sudo /sbin/ifconfig ethX -promisc

cheers

kbp

chickenlinux · 09-26-2009, 10:41 AM

well, for starters, it's a wlanX interface. I tried the commands, but replace ethX with wlan0. This appeared not to do anything

I _do_ in fact get the PROMISC, but it doesn't appear to help.

I went into wireshark after enabling promiscuous capture in this manner, and the only things I got were STP Conf.root packets and arp+tcp that were with my ip. I loaded google on my desktop connected to the same network - no packets show up. Therefore, I don't think promiscuous capture appears to be running.

any other ideas?

kbp · 09-27-2009, 10:01 AM

What capture filter are you using ?

chickenlinux · 09-28-2009, 11:00 AM

I hadn't specified any at all. Are they specified by default in the development version? I'll check...

kbp · 09-28-2009, 09:54 PM

If you hadn't selected one then you should be getting everything, the predefined filters should still be in the dev version

cheers

chickenlinux · 09-30-2009, 09:54 PM

hmm... well, if wireshark isn't the problem, and I've tried setting the wireless card to promiscuous mode (even though wireshark does that automatically) I guess it just means my Intel 5100 just doesn't work promiscuously. I know something is set for promiscuous mode when it goes into monitor... is there any way to convert the IEEE into comprehendable packet types?