Wireless Card that supports promiscuous mode in Windows 7

Question

I'm trying to use wireshark to learn a bit about networking and capturing packets. However, from what I understand, the combination of windows 7 + various wifi chips don't allow the network card to operate in "promiscuous mode". Has anyone had any experience getting this to work?

Answer 1

Beware of terminology difficulties here.

Promiscuous mode is a concept that originated on wired Ethernet, where you have your card show you all the traffic your hub is repeating onto your port, even if it's not addressed to you. Many (but not all) Wi-Fi cards support promiscuous mode, in a way that looks a lot like Ethernet promiscuous mode; it shows only the "data" frames, only on your current network (same BSSID), and it shows them after they've been translated into wired-Ethernet-style packets (Ethernet-II or 802.3 framing). The idea is to make it look just like the same traffic you'd see on a wired Ethernet interface in promiscuous mode, for the sake of network engineers that want to look at things at that level.

802.11 monitor mode is a kind super-promiscuous mode for 802.11 cards. In full monitor mode, the card is tuned to a channel and shows all the packets it can receive on that channel, no matter what. If there are other Wi-Fi networks in range on that channel, it shows you the frames from those other networks as well. It shows not only the data frames you'd see on wired Ethernet, but also the 802.11-specific "Management" (Beacon, Probe, Auth, Assoc, Action, etc.) and "Control" (Ack, RTS, CTS, PS-poll, etc.) frames as well. And it shows them untranslated, with their full 802.11-style headers.

Full 802.11 monitor mode support is harder to find in consumer Wi-Fi cards, and where it exists, it is often buggy.

Many 802.11 professionals end up opting to buy a CACE Technologies (Wireshark's corporate sponsor) "AirPcap" USB wireless card for this, since they are designed from the ground up to be great 802.11 monitor mode cards for use with Wireshark.

Update:
It's also important to note that there are really only a few Wi-Fi chipset vendors out there, and all the card makers use chips from those few vendors. The biggest vendors are Broadcom, Atheros, Marvell, and Intel, and there are several smaller lesser-known vendors such as Ralink. Of those, Atheros has long been the best chipset vendor for monitor-mode support, and open source support. You might check the Linux Wi-Fi driver community to find out which cards use Atheros chips and support the "Madwifi" driver well, and then pick one of those; they're more likely to have a Windows driver that supports monitor mode well.