312-50V10 · Question #293
An organization hires a tester to do a wireless penetration test. Previous reports indicate that the last test did not contain management or control packets in the submitted traces. Which of the follo
The correct answer is D. Certain operating systems and adapters do not collect the management or control packets.. Capturing 802.11 management and control frames requires monitor mode support, and some OS and wireless adapter combinations silently drop these frame types before they reach the capture layer.
Question
An organization hires a tester to do a wireless penetration test. Previous reports indicate that the last test did not contain management or control packets in the submitted traces. Which of the following is the most likely reason for lack of management or control packets?
Options
- AThe wireless card was not turned on.
- BThe wrong network card drivers were in use by Wireshark.
- COn Linux and Mac OS X, only 802.11 headers are received in promiscuous mode.
- DCertain operating systems and adapters do not collect the management or control packets.
How the community answered
(50 responses)- A10% (5)
- B2% (1)
- C6% (3)
- D82% (41)
Why each option
Capturing 802.11 management and control frames requires monitor mode support, and some OS and wireless adapter combinations silently drop these frame types before they reach the capture layer.
If the wireless card were off, zero frames of any type would be captured - since the tester clearly captured data frames, the card was operational.
Incorrect drivers can cause capture problems, but this is a less specific and far less common root cause than the broad OS and adapter incompatibility with management and control frame types.
On Linux and macOS, promiscuous mode does surface 802.11 headers for data frames, but the real requirement for management and control frame capture is monitor mode, and even then some adapters still do not support it.
Not all wireless NICs and their OS drivers support capturing 802.11 management (type 0) and control (type 1) frames - some adapter firmware or driver stacks silently discard these frames even when the card is in monitor mode, which would produce a trace containing only data frames and explain the missing frame types in the previous penetration test report.
Concept tested: Wireless monitor mode and 802.11 management/control frame capture
Source: https://wiki.wireshark.org/CaptureSetup/WLAN
Topics
Community Discussion
No community discussion yet for this question.