312-50V11 · Question #744
A pen-tester is configuring a Windows laptop for a test. In setting up Wireshark, what river and library are required to allow the NIC to work in promiscous mode?
The correct answer is D. Winpcap. On Windows, Wireshark requires the WinPcap driver and library to place a NIC into promiscuous mode and capture raw network packets.
Question
A pen-tester is configuring a Windows laptop for a test. In setting up Wireshark, what river and library are required to allow the NIC to work in promiscous mode?
Options
- AWinprom
- BLibpcap
- CWinpsw
- DWinpcap
How the community answered
(35 responses)- A3% (1)
- B9% (3)
- C3% (1)
- D86% (30)
Why each option
On Windows, Wireshark requires the WinPcap driver and library to place a NIC into promiscuous mode and capture raw network packets.
Winprom does not exist as a packet capture driver or library in any networking context.
Libpcap is the packet capture library used on Unix and Linux systems and is not compatible with Windows without a wrapper.
Winpsw does not exist as a packet capture driver or library in any networking context.
WinPcap is the Windows-specific packet capture driver and library that enables Wireshark to operate a NIC in promiscuous mode, capturing all traffic on the network segment rather than only traffic addressed to the host. It acts as a bridge between the Windows kernel and user-space tools like Wireshark, providing low-level packet access. Without WinPcap or its modern successor Npcap, Wireshark cannot perform raw packet capture on Windows.
Concept tested: Windows packet capture driver for promiscuous mode
Source: https://www.wireshark.org/docs/wsug_html_chunked/ChIntroPlatforms.html
Topics
Community Discussion
No community discussion yet for this question.