nerdexam
EC-Council

312-50V11 · Question #920

A pen tester is configuring a Windows laptop for a test. In setting up Wireshark, what river and library are required to allow the NIC to work in promiscuous mode?

The correct answer is D. Winpcap. WinPcap is the Windows-specific packet capture driver and library that Wireshark requires to interface with the NIC and enable promiscuous mode on Windows systems.

Sniffing

Question

A pen tester is configuring a Windows laptop for a test. In setting up Wireshark, what river and library are required to allow the NIC to work in promiscuous mode?

Options

  • ALibpcap
  • BAwinpcap
  • CWinprom
  • DWinpcap

How the community answered

(62 responses)
  • A
    3% (2)
  • B
    2% (1)
  • C
    2% (1)
  • D
    94% (58)

Why each option

WinPcap is the Windows-specific packet capture driver and library that Wireshark requires to interface with the NIC and enable promiscuous mode on Windows systems.

ALibpcap

Libpcap is the packet capture library used on Linux and Unix-based systems, not Windows, and cannot serve as the promiscuous mode driver on a Windows NIC.

BAwinpcap

Awinpcap is not a real or recognized packet capture driver, library, or Wireshark dependency on any platform.

CWinprom

Winprom does not exist as a legitimate packet capture driver or library and is not a recognized dependency for any network analysis tool.

DWinpcapCorrect

WinPcap provides a kernel-level driver and user-space API on Windows that allows Wireshark to bypass normal OS filtering and access the NIC directly, enabling promiscuous mode so all packets on the network segment are captured regardless of their destination MAC address.

Concept tested: Wireshark Windows promiscuous mode driver dependency

Source: https://www.wireshark.org/docs/wsug_html_chunked/ChapterBuildInstall.html

Topics

#Wireshark#WinPcap#promiscuous mode#packet capture

Community Discussion

No community discussion yet for this question.

Full 312-50V11 Practice