nerdexam
EC-Council

312-50V10 · Question #744

A pen-tester is configuring a Windows laptop for a test. In setting up Wireshark, what river and library are required to allow the NIC to work in promiscous mode?

The correct answer is D. Winpcap. On Windows, Wireshark requires WinPcap (or its successor Npcap) as the packet capture driver to enable promiscuous mode on the NIC.

Sniffing

Question

A pen-tester is configuring a Windows laptop for a test. In setting up Wireshark, what river and library are required to allow the NIC to work in promiscous mode?

Options

  • AWinprom
  • BLibpcap
  • CWinpsw
  • DWinpcap

How the community answered

(28 responses)
  • B
    4% (1)
  • C
    4% (1)
  • D
    93% (26)

Why each option

On Windows, Wireshark requires WinPcap (or its successor Npcap) as the packet capture driver to enable promiscuous mode on the NIC.

AWinprom

Winprom is not a real driver or library - it does not exist in any packet capture ecosystem.

BLibpcap

Libpcap is the packet capture library used on Unix/Linux systems, not on Windows.

CWinpsw

Winpsw is not a real driver or library and does not exist in any networking or packet capture context.

DWinpcapCorrect

WinPcap is the Windows-native packet capture library and kernel driver that provides the interface between user-space applications like Wireshark and the network adapter, enabling promiscuous mode capture. Without WinPcap (or Npcap), Wireshark cannot capture raw network traffic on Windows systems. It serves the same role that libpcap serves on Unix/Linux platforms.

Concept tested: Windows packet capture driver for promiscuous mode

Source: https://www.wireshark.org/docs/wsug_html_chunked/ChBuildInstallWinInstall.html

Topics

#WinPcap#Wireshark#promiscuous mode#packet capture

Community Discussion

No community discussion yet for this question.

Full 312-50V10 Practice