Possible Solution to URLSnooper on Wireless Adapters: Microsoft Network Monitor

[pogue]

I have used URL Snooper in the past, but after discovering that WinPCap doesn't support wireless adapters (for the most part) its become of limited use to me since I am unable to sniff across my wifi connection with it.  However, I recently downloaded some software called NetWitness Investigator which is a freeware packet capture suite for Windows that is a little simpler to use than WireShark.  I was reading through the manual and it had instructions for using the tool on a wireless network.

Netmon Capture Device
The Microsoft Network Monitor (Netmon) is a network analysis tool quite similar to Wireshark. Netmon can be downloaded directly from Microsoft's web site as a standalone application. Microsoft has published the underlying packet capture API that the Netmon application is based on. This means users are free to write their own custom network analysis tools in either C++ or .NET and link against the Netmon library. It is this library, namely NMAPI.dll, that the Netwitness Netmon capture device  uses.

Since Microsoft does not yet permit redistribution of the Netmon DLL, users are required to download the Netmon application directly from Microsoft, install it, then copy the NMAPI.dll from the install directory into the directory [...] This is all that is required to use the Netmon capture device.

Use the nmwifi.exe application that comes with the Microsoft Network Monitor to place the USB wireless device into monitor mode as well as set the desired frequency channel.

Windows versions prior to Vista are limited to NDIS 5, which does not support monitor (RFMON) mode. Therefore, the Netmon capture device does not support these operating systems for the purposes of wireless capture in monitor mode. However, the Netmon Capture Device does support wired capture in the same manner as WinPcap. This means that one can use the Netmon Capture device to capture wired traffic in lieu of installing WinPcap.

Here is a link to the Microsoft Network Monitor software: http://www.microsoft...details.aspx?id=4865

Netmon API info:
http://blogs.technet.com/b/netmon/
http://blogs.technet...ork-monitor-api.aspx

@Mouser: Perhaps you could look into integrating Netmon API structure into future versions of URL Snooper to allow for wireless network adapter support?  I have no coding experience personally, but just thought this was interesting and something I might pass along to you.

pogue

[mouser]

ooh, that's interesting.. and sounds quite promissing.

Can you test it for me and see if it can in fact capture on wireless networks that winpcap cannot?

[pogue]

ooh, that's interesting.. and sounds quite promissing.

Can you test it for me and see if it can in fact capture on wireless networks that winpcap cannot?

-mouser (November 26, 2011, 06:13 PM)

Well, unfortunately I have one of those network adapters that isn't compatible.  When you turn on monitoring mode it kicks me off the network.  The further documentation said that your adapter had to be compatible with NDIS 6 drivers, and apparently Intel isn't.  But I will try it on an unsecure network and see if I get any different results.

[mouser]

Please try the new version (2.34.01) -- it may fix your problem.