nerdexam
EC-Council

312-50V11 · Question #293

An organization hires a tester to do a wireless penetration test. Previous reports indicate that the last test did not contain management or control packets in the submitted traces. Which of the follo

The correct answer is D. Certain operating systems and adapters do not collect the management or control packets.. Wireless adapters and operating systems vary in their ability to capture 802.11 management and control frames even when placed in promiscuous mode. The most complete explanation is that certain OS and adapter combinations simply do not expose these frame types to the capture soft

Hacking Wireless Networks

Question

An organization hires a tester to do a wireless penetration test. Previous reports indicate that the last test did not contain management or control packets in the submitted traces. Which of the following is the most likely reason for lack of management or control packets?

Options

  • AThe wireless card was not turned on.
  • BThe wrong network card drivers were in use by Wireshark.
  • COn Linux and Mac OS X, only 802.11 headers are received in promiscuous mode.
  • DCertain operating systems and adapters do not collect the management or control packets.

How the community answered

(30 responses)
  • A
    7% (2)
  • B
    3% (1)
  • C
    17% (5)
  • D
    73% (22)

Why each option

Wireless adapters and operating systems vary in their ability to capture 802.11 management and control frames even when placed in promiscuous mode. The most complete explanation is that certain OS and adapter combinations simply do not expose these frame types to the capture software.

AThe wireless card was not turned on.

If the wireless card were completely off, no packets of any type would appear in the capture, not a selective absence of only management and control frames.

BThe wrong network card drivers were in use by Wireshark.

Incorrect or mismatched drivers would prevent Wireshark from accessing the adapter at all, not selectively filter out specific 802.11 frame categories while passing data frames through.

COn Linux and Mac OS X, only 802.11 headers are received in promiscuous mode.

While promiscuous mode on Linux and Mac OS X does have limitations around 802.11 headers in some configurations, this choice describes only a subset of platforms and does not account for adapter-level restrictions, making D the broader and more accurate answer.

DCertain operating systems and adapters do not collect the management or control packets.Correct

Certain OS and adapter combinations - particularly on Windows - will capture only data frames and omit 802.11 management and control frames even when the interface is in promiscuous mode, which explains why prior capture traces were missing those frame types. This is a well-documented hardware and driver-level limitation that affects which 802.11 frame categories are passed up to tools like Wireshark.

Concept tested: Wireless 802.11 packet capture management frame limitations

Source: https://wiki.wireshark.org/CaptureSetup/WLAN

Topics

#wireless packet capture#management frames#promiscuous mode#802.11 headers

Community Discussion

No community discussion yet for this question.

Full 312-50V11 Practice