January 5, 2021 at 12:32 pm #11439
Can the _PACKET_OID_DATA be used to set the DOT11_OPERATION_MODE_NETWORK_MONITOR in order to put a 802.11 adapter into the Monitor Mode ?
Assume that the 802.11 adapter supports this mode in hardware.January 5, 2021 at 1:56 pm #11440
You can try to, but I don’t think that it will work. I think you will need a slightly different WiFi monitoring LWF driver for this. I created one in the past from original winpkfilter, but I don’t remember all the details already…January 5, 2021 at 3:33 pm #11442
That was going to be my next question. The data received by the 802.11 adapter in the monitor mode should not have the MAC address at the beginning of the indicated packet. It must have some other stuff to accommodate the reception of raw management frames, etc…January 5, 2021 at 6:19 pm #11447January 6, 2021 at 10:00 am #11448
Yes, this is what I mean. It is not that big deal to make this type of driver from winpkfilter source code, though worth to mention that the functionality of monitoring driver is limited. If I remember fine you can read packets but not to inject them.January 7, 2021 at 11:29 am #11449
Hmm, do you know the nature of the limitation of the 802.11 drivers in Windows?
In other words, what is the DRIVER MODEL limitation inside these 802.11 adapter drivers that prevents them from injecting raw packets ?
By comparison, Linux 802.11 adapter drivers do not have that problem…January 8, 2021 at 4:01 am #11450
I never needed to inject 802.11 frames and thus never researched the subject deep. However, here are several links which could be useful:
I’ve taken a quick look at the packet11 code and from what I can see it is a little bit limited in what it can do, e.g. able to inject only management frames.January 24, 2021 at 8:19 pm #11462
The mere existence of this Packet11 driver suggests that the Miniport/adapter driver architecture does NOT limit the sending of raw 802.11 frames. Some hardware might limit it
…but not the Miniport/adapter driver architecture.January 25, 2021 at 1:25 am #11463
Agree, but the way of doing this is completely undocumented and thus may vary between Windows versions. The lack of commercial software doing this probably means that this feature is hard to implement/support.
- You must be logged in to reply to this topic.