Wireless packet capture utilities for NetMonitor

Windows Vista introduced the long awaited feature of Monitor mode for normal everyday wireless adapters. While you still can't do packet injection without resorting to expensive solutions like AirPCap TX, it's still a very useful feature to have when testing wireless security.

However tools like airodump-ng doesn't support this method as of yet, and most of the good tools for working with this are in Linux anyway, so I was looking for a way to convert NetMonitor packet captures to tcpdump/pcap format when I came across the nm2lp utility by Josh Wright which does exactly that.

Unfortunately it seems to be incompatible with x64 Windows (At least not without recompiling as 64 bit binary) and crashed on my laptop. So in good opensource tradition I decided to reinvent the wheel, this time in C# and called it nm2pcap. Afterwards I also built a airserve-ng compatible server NMServe which uses NetMonitor API to capture packets and serve them to any airodump-ng client.

NMServe enables you to use a non USB wireless adapter with a airodump-ng instance running on a VMWare BackTrack 4 installation which you otherwise can't do since VMWare doesnt support non usb devices to be attached to the guest os. You could even use it with the windows airodump-ng binaries though that seems a bit flaky. The only snag is that it cannot put the adapter into Monitor mode automatically. You will need to do it manually using the nmwifi.exe which comes with NetMonitor before running NMServe. I'd probably fix this later.

The NMUtils binaries and the source code are available under LGPL v2 license.

4 comments:

  1. This comment has been removed by the author.

    ReplyDelete
  2. loving the Nmutils, nice work, specially usefull for non airserv-ng compatible cards, I found them today and they works like a charm, especially nmserve, however it crash sometimes with airdump-ng on win 7 x64, also if you could implement injection support for aireplay-ng it would be awesome, tested with a wifi link 1000 bgn with positive results using airodump-ng, really nice work , I posted a link to this site on some spanish forums, I hope it will not be an inconvenience for you.

    ReplyDelete
  3. I'm getting this error message when trying to convert from netmon to pcap

    Initalising Parser: No files were loaded and parsed.
    Initalising Parser: Encountered an unexpected error while parsing the script fil
    e: The system cannot find the file specified.
    (WinStatusCode = 0x00000002).
    Initalising Parser: Encountered errors while loading '' file.

    Unhandled Exception: System.Exception: Creation of configuration parser failed
    at NMHelper.NMFrameParser.Init()
    at nm2pcap.Program.Main(String[] args)

    Any thoughts as to what I'm doing wrong?

    ReplyDelete
  4. Popularity of remote computer support has been increasing rapidly in the recent times. This mode of service is safe, convenient and easily attainable. Go through the article and learn more about remote computer support.RouterReset

    ReplyDelete