Very easy question about promiscious / monitor modes.

[michael_kent123]

Promiscuous mode - ability to see packets on the wifi network you are connected to that are not directed to your MAC.

Monitor mode - ability to see packets on wifi networks to which you are not connected but that your NIC can sniff.

However, since modern networks are switches rather than hubs, promiscuous mode no longer really exists.

Therefore, am I correct when I say that:

Monitor mode is like promiscuous mode for the network you are connected to plus you can also view nearby networks.

So, if I am on SSID "Hello" and my friend is on "Hello" and he sends a non-SSL username:password to his e-mail provider, and I am in monitor mode, then I can view that password in Wireshark.

Is that correct? Thanks!

[RhYtHmMaStEr]

Hi Michael,

In Promiscuous mode, if you are connected to a hub you are correct however if not you probably only see ARP and BROADCAST activity in addition to your local node.

If you want to enable monitor mode:

ifconfig wlan0 down

iwconfig wlan0 mode monitor

ifconfig wlan0 up

Try that and see if you do see additional traffic.

[cooper]

Isn't it also true that you can't inject unless you're in promiscuous mode?

[michael_kent123]

Isn't it also true that you can't inject unless you're in promiscuous mode?

Yes. My impression is that, with the Alfa, monitor mode is promiscious mode.

It's just a question of terminology.

[cooper]

I know for a fact you had promiscuous mode before wifi existed and always thought it meant your network adapter would willingly pass onto the OS's network layer anything that flowed in and allowing it to spew out any stream of bits you deemed fit for the network, regardless of protocol or good taste. It truly did make your device a complete whore to the network.