USB wireless adapter which supports promiscuous mode (as opposed to monitor mode) in BackTrack

Question

Hi to all! As the title says, I'm looking for an USB wireless adapter which supports promiscuous mode to work with Wireshark in BackTrack. I have an ALFA AWUS036H, but it (seems it) can be put only in monitor mode. I'm looking for an USB adapter, since I'm running BackTrack in a Virtual machine. Thanks in advance for your help!

Answer 1

1

The TP-Link TL-WN822N works well for me. BackTrack 5R3 in Vmware. USB device mapped to the virtual machine.

Regards
Kurt

answered 04 Dec '12, 16:30

Kurt Knochner ♦
24.8k●10●39●237
accept rate: 15%

Thanks a lot for your answer! I discovered there are two versions of this adapter: link text

and

link text

Can you tell me which chip is in yours? Thanks in advance!

(05 Dec '12, 10:30) Mr Wolf

1

V2. AR7010 + AR9287. Driver: ath9k_htc

[email protected]:~# lsusb
Bus 002 Device 003: ID 0e0f:0002 VMware, Inc. Virtual USB Hub
Bus 002 Device 002: ID 0e0f:0003 VMware, Inc. Virtual Mouse
Bus 002 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 001 Device 002: ID 0cf3:7015 Atheros Communications, Inc. TP-Link TL-WN821N v3 802.11n [Atheros AR7010+AR9287]
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

Strange: lsusb reports a TL-WN821N V3, although at the back of the device it's clearly written: TL-WN822N V2.

(05 Dec '12, 11:29) Kurt Knochner ♦

Hi! Thanks again! I've just bought this adapter. It's version 2. I'm trying to make it work on BackTrack 5 under VirtualBox, but it can't be recognized :/ Following some guide, I tried to install compat-wireless: http://linuxwireless.org/en/users/Download/stable/ but it doesn't work either. Did you install drivers of any kind or it was automatically recognized?

(16 Dec '12, 09:00) Mr Wolf

1

Did you install drivers of any kind or it was automatically recognized?

No. Out-of-the box BackTrack 5R3. However, I'm using VMware Workstation 9 instead of Virtualbox. Maybe the USB mapping to your virtual machine does not work properly with Virtualbox.

What do you see with dmesg and lsusb after you mapped the USB port to your virtual machine?

(16 Dec '12, 11:04) Kurt Knochner ♦

Ok... Here's a screenshot: http://i1209.photobucket.com/albums/cc399/MrWolf80/Error_zps2821af63.jpg after giving the commands dmesg and lsusb. I think you're just right: it's a VirtualBox USB problem, I tried with a BackTrack live cd and the wireless adapter works (I haven't tried it in promiscuous mode, yet). Now, I also remember I've already found a topic somewhere about wireless USB adapter (maybe just this one) not working with VirtualBox. I'll try to find it and see if the problem was solved. I think the "faster" solution is to migrate to VMWare. Many thanks for your help for now! :)

(16 Dec '12, 13:13) Mr Wolf

1

I tried with a BackTrack live cd and the wireless adapter works

well, then is really sounds like a problem with Virtualbox and USB. I have no problem at all with VMware. The adapter works just fine.

I think the "faster" solution is to migrate to VMWare.

Maybe. You can use VMware Player for free (personal use only!)

Many thanks for your help for now! :)

You're welcome!

HINT: If a supplied answer resolves your question can you please "accept" it by clicking the checkmark icon next to it. This highlights good answers for the benefit of subsequent users with the same or similar questions.

(16 Dec '12, 15:11) Kurt Knochner ♦

Ok, just to let you know :) I installed VMware and then installed BackTrack 5 R3 and it works much faster than on VirtualBox! TL-WN821N was immediately recognized and worked, except for the fact VMware claims it supports USB 3.0, but it doesn't! :( tsk Then, I tried promiscuous mode: first of all, with my network without password, and I verified the adapter actually works in promiscuous mode; then, I tried with password set on: be aware the version of Wireshark installed in BackTrack 5 R3, 1.8.2, has a bug which gives you error when you enter wpa-psk, so I installed 1.8.4 from Ubuntu repositories, which solved the bug. At this point, I wasn't able to decrypt traffic through my network, since I couldn't get the 4 handshake packets, but only packets 1 and 3. I don't know what's the problem now, if another bug, or just my problem. :(

(02 Jan '13, 11:55) Mr Wolf

1

I have no idea why you cannot see the last packet. I will try myself with Wireshark 1.8.4 from the Ubuntu repositories and report my findings.

BTW: Did you try to capture with tcpdump? If no: please do so.

(02 Jan '13, 12:31) Kurt Knochner ♦

showing 5 of 8 show 3 more comments

Answer 2

Mmmm... I think what the problem can be: link text

I think it has to do with speed rate. In my case, my router can work at 108Mbps, but it can be put it at 54Mbps, but also the network adapter must work at the same speed. I tried to set it with: iwconfig wlan1 rate 54G but, for now, no success, I can't decrypt my network traffic. :( I'll have to make other attempts.