Re: dwepcrack _works_

Supposedly people have been able to get monitor mode stuff to work with
orinoco cards with certain firmware versions. I'm currently looking into
this a bit, but if anyone would like to try to code support for it, I could
really use the help.

On 10/27/02 4:35 AM, "Scott Augustus" <[email protected]> wrote:

> Quoting h1kari <[email protected]>:
> 
>> I'm planning on moving everything over to straight monitor
>> mode and abandoning all of the scan mode stuff and make dstumbler into more
>> of an analysis/injection/attack console gui.
> 
> Anyone care to detail the differences and pros/cons of monitor vs. scan modes?
> Monitor mode is a feature only available to prism2 cards is it not?

With monitor mode you can get a lot more information about the networks in
the area than with scan mode. You can also detect closed ap's and also adhoc
networks that don't use any 802.11 management packets as well as do a lot
more data analysis and such. All scan mode does is makes the card keep track
of the aps in the area (based on beacon packets it sees) and report a list
of all of the ones it sees. This information is sometimes unreliable and it
requires polling which can only be done at ~ 1 second intervals and puts
some strain on the card. Whereas with monitor mode you can control the
channel hopping, and analyze the raw 802.11 packets to find aps as well as
machines connected to the aps. Add on some injection and there are numerous
active attacks that can be done on the network. Either way, monitor mode is
the way to go.

-h1kari


-- 
David Hulton <[email protected]>
Senior Researcher, Dachb0den Labs
http://www.dachb0den.com