nerdexam
EC-Council

312-50V10 · Question #920

A pen tester is configuring a Windows laptop for a test. In setting up Wireshark, what river and library are required to allow the NIC to work in promiscuous mode?

The correct answer is D. Winpcap. Wireshark on Windows requires WinPcap as the packet capture driver and library to enable promiscuous mode on the NIC and capture raw network frames.

Sniffing

Question

A pen tester is configuring a Windows laptop for a test. In setting up Wireshark, what river and library are required to allow the NIC to work in promiscuous mode?

Options

  • ALibpcap
  • BAwinpcap
  • CWinprom
  • DWinpcap

How the community answered

(60 responses)
  • A
    5% (3)
  • B
    2% (1)
  • C
    2% (1)
  • D
    92% (55)

Why each option

Wireshark on Windows requires WinPcap as the packet capture driver and library to enable promiscuous mode on the NIC and capture raw network frames.

ALibpcap

Libpcap is the Unix/Linux equivalent of WinPcap and is not compatible with Windows operating systems.

BAwinpcap

Awinpcap is not a real packet capture driver or library and does not exist in any recognized network capture framework.

CWinprom

Winprom is not a valid packet capture library or driver and does not exist as a tool for enabling promiscuous mode on Windows.

DWinpcapCorrect

WinPcap is the Windows packet capture architecture consisting of a kernel-level driver and a user-space DLL that gives Wireshark low-level network access and the ability to set the NIC to promiscuous mode. Without WinPcap (or its modern successor Npcap) installed, Wireshark cannot capture packets below the socket layer on Windows systems.

Concept tested: WinPcap driver for Wireshark promiscuous mode on Windows

Source: https://www.wireshark.org/docs/wsug_html_chunked/ChIntroPlatforms.html

Topics

#Wireshark#WinPcap#promiscuous mode#packet capture

Community Discussion

No community discussion yet for this question.

Full 312-50V10 Practice