Hi,

I am using the latest Wireshark on my FC6 distro with an Intel ipw2200 mini-pci card. I am trying to capture all 802.11 frames received (and destined for) by only that client (i.e. non-promiscuously).

At the moment it captures everything arriving to it as expected, but there are no 802.11 header per packet - only Ethernet headers.

My ipw2200 card is in Managed mode as it is actually connected to the wlan being studied, and receiving and sending real traffic.

I know that the card must be put into Monitor mode if I want to see all the 802.11 data in my Wireshark captures, but then obviously i lose connectivity from the wlan, and thus cannot send or receive real traffic data anymore - which goes against what i am trying to do in my experiments. Thus, the card must remain in a Managed mode, and yet still pass all 802.11 information up to Wireshark. This is my dilemma.

I have searched endlessly on the Internet for ways around this, and have found only a few articles that touch briefly on the subject, without giving too much detail. From what i'm reading out there, i think there is a way around this by using a specific type of card/driver combination?

Others have mentioned making modifications to the driver for my card (ipw2200)?

I also read that the mad-wifi and hostap drivers might be able to do what I need, but from their respective project websites i couldn't find these answers. Also, would they work with my ipw2200 card?

So, if anybody out there could perhaps shed some light on this issue it would be helping me out a great deal.

Thanks in advance for your time.

Ritesh

The MadWiFi driver will not work with your Intel card.

One of the cool features of the Atheros chipset/ MadWiFi combo is the ability to use virtual interfaces. You can run one in managed mode and carve out another one for monitor. Very slick.

Alternatively, you could add a cheap Prism card to the config for monitoring.

Thanks for that information, it does sound very slick!

Unfortunately I do not have access to an Atheros chipset card, or a Prism one.

I've been working on my dilemma for the past few hours and have ended up adding a second wireless pcmcia adaptor (a cisco aironet 350) (eth2) to the same notebook, which can be put into monitor mode and capture all 802.11 frames near to the notebook.

The consensus is that if the original adaptor (eth1) can see 802.11 frames, then so should (eth2) - giving high levels of accuracy as to which frames were actually received by the client.

Of course this is a crude way of doing what I need, but for now i will have to make assumptions.

If anybody has any suggestions or tips with my current setup then my ears are open...

Ritesh