312-50V11 · Question #920
A pen tester is configuring a Windows laptop for a test. In setting up Wireshark, what river and library are required to allow the NIC to work in promiscuous mode?
The correct answer is D. Winpcap. WinPcap is the Windows-specific packet capture driver and library that Wireshark requires to interface with the NIC and enable promiscuous mode on Windows systems.
Question
A pen tester is configuring a Windows laptop for a test. In setting up Wireshark, what river and library are required to allow the NIC to work in promiscuous mode?
Options
- ALibpcap
- BAwinpcap
- CWinprom
- DWinpcap
How the community answered
(62 responses)- A3% (2)
- B2% (1)
- C2% (1)
- D94% (58)
Why each option
WinPcap is the Windows-specific packet capture driver and library that Wireshark requires to interface with the NIC and enable promiscuous mode on Windows systems.
Libpcap is the packet capture library used on Linux and Unix-based systems, not Windows, and cannot serve as the promiscuous mode driver on a Windows NIC.
Awinpcap is not a real or recognized packet capture driver, library, or Wireshark dependency on any platform.
Winprom does not exist as a legitimate packet capture driver or library and is not a recognized dependency for any network analysis tool.
WinPcap provides a kernel-level driver and user-space API on Windows that allows Wireshark to bypass normal OS filtering and access the NIC directly, enabling promiscuous mode so all packets on the network segment are captured regardless of their destination MAC address.
Concept tested: Wireshark Windows promiscuous mode driver dependency
Source: https://www.wireshark.org/docs/wsug_html_chunked/ChapterBuildInstall.html
Topics
Community Discussion
No community discussion yet for this question.