Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Trying to do 802.11 capture with RTL8812AU #1786

Open
yujuiwu opened this issue Oct 15, 2019 · 1 comment

Comments

@yujuiwu
Copy link

@yujuiwu yujuiwu commented Oct 15, 2019

Dear development team,

I'm trying to do raw wireless capture with RTL8821AU and find that it works with the Microsoft Network Monitor (https://www.techspot.com/downloads/4207-microsoft-network-monitor.html) but does not work with wireshark + npcap.

I wanted to see if npcap could actually get the frames reported by RTL8812AU so I installed a debug version of npcap(https://nmap.org/npcap/dist/npcap-0.96-debug.exe), but I can't observe a log similar to the one reported here: #1036 (comment) (especially NPF_AttachAdapter), but only some log prefixed with "KMLOOP". So I'm not sure if npcap works with RTL8812AU.

So my issue is how can I make npcap work with RTL8821AU

Here's my environment:
Wi-Fi driver: from realtek.com.tw, 1030.25.0701.2017, used the Windows 8.1 driver
OS: Win10 18362 x86
Wiresharek version: 3.0.5
npcap version: npcap-0.96-debug.exe

According to https://secwiki.org/w/Npcap/WiFi_adapters, I know that it can be switched into monitor mode, but capture does not work. However, as it works with Microsoft Network Monitor, I'm just trying to figure out why is that.

DiagReport-20191014-183630.txt

Thanks!

@yujuiwu

This comment has been minimized.

Copy link
Author

@yujuiwu yujuiwu commented Oct 22, 2019

Ok, I built the debug version of NPCAP from source and got the log prefixed with "NPF_".

I also found that RTL8812AU has some issue with the latest NPCAP (v0.9983) but the previous versions (9982, 9981, 0.99r9) are good.

After getting the proper NPCAP version, there's one more trick, we have to connect it to an AP at least once so that its monitor mode works (e.g. connect -> disconnect -> switch to monitor mode -> capture).

The driver I'm using is a Win8.1 driver because the link below says that a Win10 WDI driver does not support monitor mode.
MicrosoftDocs/windows-driver-docs#1476 (comment)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
1 participant
You can’t perform that action at this time.