312-50V10 · Question #920
A pen tester is configuring a Windows laptop for a test. In setting up Wireshark, what river and library are required to allow the NIC to work in promiscuous mode?
The correct answer is D. Winpcap. Wireshark on Windows requires WinPcap as the packet capture driver and library to enable promiscuous mode on the NIC and capture raw network frames.
Question
A pen tester is configuring a Windows laptop for a test. In setting up Wireshark, what river and library are required to allow the NIC to work in promiscuous mode?
Options
- ALibpcap
- BAwinpcap
- CWinprom
- DWinpcap
How the community answered
(60 responses)- A5% (3)
- B2% (1)
- C2% (1)
- D92% (55)
Why each option
Wireshark on Windows requires WinPcap as the packet capture driver and library to enable promiscuous mode on the NIC and capture raw network frames.
Libpcap is the Unix/Linux equivalent of WinPcap and is not compatible with Windows operating systems.
Awinpcap is not a real packet capture driver or library and does not exist in any recognized network capture framework.
Winprom is not a valid packet capture library or driver and does not exist as a tool for enabling promiscuous mode on Windows.
WinPcap is the Windows packet capture architecture consisting of a kernel-level driver and a user-space DLL that gives Wireshark low-level network access and the ability to set the NIC to promiscuous mode. Without WinPcap (or its modern successor Npcap) installed, Wireshark cannot capture packets below the socket layer on Windows systems.
Concept tested: WinPcap driver for Wireshark promiscuous mode on Windows
Source: https://www.wireshark.org/docs/wsug_html_chunked/ChIntroPlatforms.html
Topics
Community Discussion
No community discussion yet for this question.