312-50V10 · Question #744
A pen-tester is configuring a Windows laptop for a test. In setting up Wireshark, what river and library are required to allow the NIC to work in promiscous mode?
The correct answer is D. Winpcap. On Windows, Wireshark requires WinPcap (or its successor Npcap) as the packet capture driver to enable promiscuous mode on the NIC.
Question
A pen-tester is configuring a Windows laptop for a test. In setting up Wireshark, what river and library are required to allow the NIC to work in promiscous mode?
Options
- AWinprom
- BLibpcap
- CWinpsw
- DWinpcap
How the community answered
(28 responses)- B4% (1)
- C4% (1)
- D93% (26)
Why each option
On Windows, Wireshark requires WinPcap (or its successor Npcap) as the packet capture driver to enable promiscuous mode on the NIC.
Winprom is not a real driver or library - it does not exist in any packet capture ecosystem.
Libpcap is the packet capture library used on Unix/Linux systems, not on Windows.
Winpsw is not a real driver or library and does not exist in any networking or packet capture context.
WinPcap is the Windows-native packet capture library and kernel driver that provides the interface between user-space applications like Wireshark and the network adapter, enabling promiscuous mode capture. Without WinPcap (or Npcap), Wireshark cannot capture raw network traffic on Windows systems. It serves the same role that libpcap serves on Unix/Linux platforms.
Concept tested: Windows packet capture driver for promiscuous mode
Source: https://www.wireshark.org/docs/wsug_html_chunked/ChBuildInstallWinInstall.html
Topics
Community Discussion
No community discussion yet for this question.