nerdexam
EC-Council

312-50V9 · Question #66

An organization hires a tester to do a wireless penetration test. Previous reports indicate that the last test did not contain management or control packets in the submitted traces. Which of the follo

The correct answer is D. Certain operating systems and adapters do not collect the management or control packets.. Management and control frames may be absent from wireless captures because certain operating systems and wireless adapters do not expose these 802.11 frame types to capture tools even in monitor mode.

Hacking Wireless Networks

Question

An organization hires a tester to do a wireless penetration test. Previous reports indicate that the last test did not contain management or control packets in the submitted traces. Which of the following is the most likely reason for lack of management or control packets?

Options

  • AThe wireless card was not turned on.
  • BThe wrong network card drivers were in use by Wireshark.
  • COn Linux and Mac OS X, only 802.11 headers are received in promiscuous mode.
  • DCertain operating systems and adapters do not collect the management or control packets.

How the community answered

(35 responses)
  • A
    6% (2)
  • B
    3% (1)
  • C
    17% (6)
  • D
    74% (26)

Why each option

Management and control frames may be absent from wireless captures because certain operating systems and wireless adapters do not expose these 802.11 frame types to capture tools even in monitor mode.

AThe wireless card was not turned on.

If the wireless card were not turned on, no packets at all would be captured, not just a selective absence of management and control frame types.

BThe wrong network card drivers were in use by Wireshark.

Incorrect drivers would more likely cause complete capture failure or system instability rather than selectively filtering only management and control frames.

COn Linux and Mac OS X, only 802.11 headers are received in promiscuous mode.

On Linux and Mac OS X, promiscuous mode does not yield raw 802.11 frames - monitor mode is required - but this choice incorrectly implies only headers are received and does not accurately explain the selective absence of management and control frames.

DCertain operating systems and adapters do not collect the management or control packets.Correct

Not all wireless adapters and their drivers expose management frames (beacons, probe requests) and control frames (ACK, RTS/CTS) to capturing tools - this depends on the adapter chipset and OS-level driver support for monitor mode. Even when monitor mode is enabled, some OS and adapter combinations silently drop these frame types, resulting in traces that contain only data frames.

Concept tested: Wireless adapter and OS limitations in 802.11 frame capture

Source: https://wiki.wireshark.org/CaptureSetup/WLAN

Topics

#wireless packet capture#management frames#802.11#promiscuous mode

Community Discussion

No community discussion yet for this question.

Full 312-50V9 Practice