nerdexam
EC-Council

312-50V10 · Question #293

An organization hires a tester to do a wireless penetration test. Previous reports indicate that the last test did not contain management or control packets in the submitted traces. Which of the follo

The correct answer is D. Certain operating systems and adapters do not collect the management or control packets.. Capturing 802.11 management and control frames requires monitor mode support, and some OS and wireless adapter combinations silently drop these frame types before they reach the capture layer.

Hacking Wireless Networks

Question

An organization hires a tester to do a wireless penetration test. Previous reports indicate that the last test did not contain management or control packets in the submitted traces. Which of the following is the most likely reason for lack of management or control packets?

Options

  • AThe wireless card was not turned on.
  • BThe wrong network card drivers were in use by Wireshark.
  • COn Linux and Mac OS X, only 802.11 headers are received in promiscuous mode.
  • DCertain operating systems and adapters do not collect the management or control packets.

How the community answered

(50 responses)
  • A
    10% (5)
  • B
    2% (1)
  • C
    6% (3)
  • D
    82% (41)

Why each option

Capturing 802.11 management and control frames requires monitor mode support, and some OS and wireless adapter combinations silently drop these frame types before they reach the capture layer.

AThe wireless card was not turned on.

If the wireless card were off, zero frames of any type would be captured - since the tester clearly captured data frames, the card was operational.

BThe wrong network card drivers were in use by Wireshark.

Incorrect drivers can cause capture problems, but this is a less specific and far less common root cause than the broad OS and adapter incompatibility with management and control frame types.

COn Linux and Mac OS X, only 802.11 headers are received in promiscuous mode.

On Linux and macOS, promiscuous mode does surface 802.11 headers for data frames, but the real requirement for management and control frame capture is monitor mode, and even then some adapters still do not support it.

DCertain operating systems and adapters do not collect the management or control packets.Correct

Not all wireless NICs and their OS drivers support capturing 802.11 management (type 0) and control (type 1) frames - some adapter firmware or driver stacks silently discard these frames even when the card is in monitor mode, which would produce a trace containing only data frames and explain the missing frame types in the previous penetration test report.

Concept tested: Wireless monitor mode and 802.11 management/control frame capture

Source: https://wiki.wireshark.org/CaptureSetup/WLAN

Topics

#wireless packet capture#promiscuous mode#802.11 frames#Wireshark

Community Discussion

No community discussion yet for this question.

Full 312-50V10 Practice