|
Monitor mode aka rfmon mode is similar to promiscuous mode. It operates on a wireless card and instead of sniffing all the traffic from the associated network, sniffs all the traffic that the card recieves. Usually, the card is unable to transmit or otherwise be used when in this mode. Promiscuous mode, in computer related fields, is generally used to refer to the practice of putting a network card into a setting so that it passes all traffic it receives to the CPU rather than just packets addressed to it. ...
It is also used for passive stumbling, a technique used in wardriving where the wireless card listens for base stations instead of actively probing them to determine their presence. War driving is often a surreptitious activity: this long-range wardriver leaves only his shadow. ...
However, on Mac OS X, KisMac can create an interface for the card in monitor mode, on AirPort Extreme cards. It is named wlt1, and can be captured from with ethereal, tcpdump or any other tool. This article is about the network traffic analyzer. ...
tcpdump is a common computer network debugging tool that runs under the command line. ...
The only problem is that the card will be kept on whatever channel it was on before, and capturing traffic from all channels is not possible. It does not generally have any positive uses beside troubleshooting. Often it is used in malicious ways, such as packet sniffing or WEP cracking. |