Network Monitor Operation Mode

  • Article

Important  The Native 802.11 Wireless LAN interface is deprecated in Windows 10 and later. Please use the WLAN Device Driver Interface (WDI) instead. For more information about WDI, see WLAN Universal Windows driver model.

 

In the Network Monitor (NetMon) operation mode, the 802.11 station operates as a wireless LAN (WLAN) device that is used to monitor packets that are sent over the WLAN media by other devices.

A miniport driver enters the NetMon mode when it receives an OID_DOT11_CURRENT_OPERATION_MODE request with the uCurrentOpMode member of DOT11_CURRENT_OPERATION_MODE set to DOT11_OPERATION_MODE_NETWORK_MONITOR.

In order to operate in NetMon mode, the miniport driver must:

  • Support raw packet receive indications, as described in Indicating Raw 802.11 Packets.

  • Support the promiscuous packet receive indications, as described in Guidelines for 802.11 Promiscuous Receive Operations.

  • Support all mandatory NDIS generic OIDs.

  • Support the following subset of Native 802.11 NDIS OID interfaces for the configuration of 802.11 MAC or PHY MIB attributes:

    OID_DOT11_CURRENT_CHANNEL
    While in NetMon mode, the miniport driver must support changing to any 802.11b/g channel (channels 1-14) and must disable any channel validation that is being done for regulatory domain compliance.

    OID_DOT11_CURRENT_FREQUENCY
    While in NetMon mode, the miniport driver must support changing to any 802.11a channel and must disable any channel validation that is being done for regulatory domain compliance.

    OID_DOT11_CURRENT_OPERATION_MODE
    Switches the miniport driver into another operational mode, for example Extensible Station (ExtSTA) mode.

    OID_DOT11_CURRENT_PHY_ID
    Sets or returns the PHY identifier of the ExtSTA MIB object.

    OID_DOT11_DESIRED_PHY_LIST
    Enables the PHYs on which the NIC should monitor traffic. If the NIC cannot support packet reception on multiple PHYs concurrently, it should monitor traffic on the first PHY in the desired PHY list. If the desired PHY list contains DOT11_PHY_ID_ANY, the NIC can choose which PHY to monitor.

    OID_DOT11_STATISTICS
    Provides statistics counters in NetMon mode.

In addition, while the driver is operating in NetMon mode, the 802.11 station must not:

  • Send an 802.11 ACK frame for each received packet.

  • Reject duplicate 802.11 packets.

  • Switch out of the 802.11 Constantly Awake Mode (CAM) power mode if it is in the D0 power state. For more information, see 802.11 Power Management.

While in NetMon mode, the miniport driver can only receive packets based on the current packet filter settings. The driver cannot send packets either on its own or through a call to its MiniportSendNetBufferLists function.

When the miniport driver enters NetMon mode, the NIC must disable any background scanning that it has implemented.

For more information about the 802.11 packet filter settings, see OID_GEN_CURRENT_PACKET_FILTER.