Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Having searched a great deal of websites to find an explicit statement about the specifics of Promiscuous and Monitor mode as used in WNICs, I finally found this in Spiff's answer to: Wireless Card that supports promiscuous mode in Windows 7. His answer is supposedly correct, however, I need a creditable source to cite. I haven't been able to verify Spiff's statement in the 802.11 standard, but perhaps I was looking at the wrong document. Unfortunately I can't comment to answers yet or contact him directly, hence this question.

share|improve this question

There's nothing in the 802.11 standard about promiscuous or monitor mode. The word "promiscuous" appears (at least according to my copy of 802.11-2011 and the OS X Preview application reading it) in exactly one place in the standard:

NOTE 2—Any secure network cannot support promiscuous association, e.g., an unsecured operation of IEEE Std 802.11. A trust relationship is needed between the STA and the AS of the targeted SSID prior to association and secure operation, in order for the association to be trustworthy. The reason is that an attacker can deploy a rogue AP just as easily as a legitimate network provider can deploy a legitimate AP, so some sort of prior relationship is necessary to establish credentials between the ESS and the STA.

which is in section "Security association in an ESS". The word "monitor" appears in a number of places, none of them connected with monitor mode.

It's up to the vendor of a particular 802.11 adapter, and to the writer of the driver for that adapter for a particular OS (which may or may not be the vendor of the adapter), to make promiscuous or monitor mode work. The 802.11 standard neither requires nor prohibits it.

For Windows, the closest thing to a "creditable source" for Spiff's general discussion of promiscuous and monitor mode would be Microsoft's MSDN site. In particular, see their page discussing monitor mode for "Native 802.11" drivers and their page about NDIS "packet filters" (which are not the same as, for example, "capture filters" in libpcap/WinPcap and applications such as tcpdump and Wireshark that use libpcap/WinPcap).

Those sources will not, however, say anything about particular network adapters or their drivers. The closest thing to a "creditable source" indicating whether a particular network adapter and its Windows driver support promiscuous mode or monitor mode would be the documentation for that adapter and its driver, if they bother to say anything about that.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .