nerdexam
EC-Council

312-50V11 · Question #744

A pen-tester is configuring a Windows laptop for a test. In setting up Wireshark, what river and library are required to allow the NIC to work in promiscous mode?

The correct answer is D. Winpcap. On Windows, Wireshark requires the WinPcap driver and library to place a NIC into promiscuous mode and capture raw network packets.

Sniffing

Question

A pen-tester is configuring a Windows laptop for a test. In setting up Wireshark, what river and library are required to allow the NIC to work in promiscous mode?

Options

  • AWinprom
  • BLibpcap
  • CWinpsw
  • DWinpcap

How the community answered

(35 responses)
  • A
    3% (1)
  • B
    9% (3)
  • C
    3% (1)
  • D
    86% (30)

Why each option

On Windows, Wireshark requires the WinPcap driver and library to place a NIC into promiscuous mode and capture raw network packets.

AWinprom

Winprom does not exist as a packet capture driver or library in any networking context.

BLibpcap

Libpcap is the packet capture library used on Unix and Linux systems and is not compatible with Windows without a wrapper.

CWinpsw

Winpsw does not exist as a packet capture driver or library in any networking context.

DWinpcapCorrect

WinPcap is the Windows-specific packet capture driver and library that enables Wireshark to operate a NIC in promiscuous mode, capturing all traffic on the network segment rather than only traffic addressed to the host. It acts as a bridge between the Windows kernel and user-space tools like Wireshark, providing low-level packet access. Without WinPcap or its modern successor Npcap, Wireshark cannot perform raw packet capture on Windows.

Concept tested: Windows packet capture driver for promiscuous mode

Source: https://www.wireshark.org/docs/wsug_html_chunked/ChIntroPlatforms.html

Topics

#Wireshark#promiscuous mode#WinPcap#packet capture

Community Discussion

No community discussion yet for this question.

Full 312-50V11 Practice