Wireless Monitoring with LinkFerret™


Why does LinkFerret need to provide a driver?

Wireless LAN technology burst onto the scene so rapidly that the protocol stacks developed for the major operating systems such as Windows couldn't be modified quickly enough to "understand" this new media. Card vendors took the approach that has typically been used when porting a piece of hardware to a system that did not understand it. They emulated a device that the system did know about, in this case Ethernet, and were therefor able to immediately deploy their adapters without waiting for the system software to catch up.

This approach works well for ordinary communication, however the consequence is that there is no uniform way to place a wireless adapter into a mode in which the network can be monitored. In order to truly see inside the network a packet sniffer must be able to view the raw 802.11 traffic.

Every packet sniffer that offers true wireless monitoring support must provide a custom driver, which includes promiscuous MAC-level capture, for each wireless card that it supports. LinkFerret supports both Cisco/Aironet 340/350 and WaveLAN/Orinoco wireless adapters. Please note that USB adapters are not currently supported. We have drivers in development for several other popular wireless cards. They will be available as an update in the near future.


What happens when I install the LinkFerret driver?

After it is installed, the LinkFerret capture driver "owns" the adapter. Normal system functions will not be able to use this adapter while the capture driver is in place. Use the LinkFerret driver when you are setting up a monitoring session. When you are ready to resume normal system operation then simply repeat the steps listed below for the appropriate operating system and specifying the original driver.

This is an important point. While the LinkFerret driver is installed the operating system icon for the that device may show it as "disabled" or "disconnected." This is normal behavior. As far as the operating system's networking functions are concerned the device is disabled and disconnected. The LinkFerret monitor will still work correctly. When the monitoring session is completed and you restore the original driver the device will be re-enabled as far as the system is concerned and you will be able to use the connection just as before.


Installing LinkFerret's Wireless Driver on Windows 2000

  1. Install the adapter per the manufacturer's instructions
  2. If the device is removable then make sure that it is inserted
  3. Invoke the Control Panel and select the "System" icon
  4. Select the "Hardware" tab
  5. Select "Device Manager"
  6. Open network adapters tree view node
  7. Select the [Cisco/Aironet or WaveLAN/Orinoco] adapter
  8. From the property sheet select "Driver"
  9. Select "Update driver"
  10. Follow directions provided, and specify "Search for a driver", indicating that the system should look in:

    "Program Files\Baseband Technologies\Linkferret Network Monitor\drivers"

    The name of the .inf file describing the driver is either lfan4500.inf for the Cisco/Aironet adapter or lfprism.inf for the WaveLAN/Orinoco. Most likely the LinkFerret driver will not be specified as the recommended choice. If it is not, then check the "install one of the other drivers" checkbox and follow the instructions given.
  11. When the update has completed, return to the "Connection Properties" screen. If any filter or intermediate drivers are listed, then clear the check mark so that they are not bound to the LinkFerret driver. Examples of this type of driver are the Microsoft QoS Packet Scheduler, the MAC Bridge, and VPN's.
  12. After the driver is installed successfully it will appear on LinkFerret's "Select capture device..." menu selection with the phrase "[LinkFerret-Capture]" contained within the description.
  13. Although in some cases it may not be necessary, we recommend that you reboot the system before using LinkFerret.


Installing LinkFerret's Wireless Driver on Windows XP

  1. Install the adapter per the manufacturer's instructions
  2. If the device is removable then make sure that it is inserted
  3. Invoke the "Start" menu and select "My Computer"
  4. Select "My Network Places"
  5. Select "View Network Connections"
  6. Right-click on the icon for the [Cisco/Aironet or WaveLAN/Orinoco] wireless card
  7. Select "Properties" on the dropdown menu
  8. Select "Configure"
  9. Select the "Driver" tab
  10. Select "Update Driver"
  11. Check the "Install from location" button
  12. Check the "don't search" button
  13. Select "Have Disk"
  14. Indicate that the system should look in:

    "Program Files\Baseband Technologies\Linkferret Network Monitor\drivers"

    The name of the .inf file describing the driver is either lfan4500.inf for the Cisco/Aironet adapter or lfprism.inf for the WaveLAN/Orinoco. Most likely the LinkFerret driver will not be specified as the recommended choice. If it is not, then check the "install one of the other drivers" checkbox and follow the instructions given. After the driver is installed successfully it will appear on LinkFerret's "Select capture device..." menu selection with the phrase "[LinkFerret-Capture]" contained within the description.
  15. When the update has completed, return to the "Connection Properties" screen. If any filter or intermediate drivers are listed, then clear the check mark so that they are not bound to the LinkFerret driver. Examples of this type of driver are the Microsoft QoS Packet Scheduler, the MAC Bridge, and VPN's. Please note, the QoS Driver is installed by default. If it is not unchecked then wireless capture will not occur.
  16. After the driver is installed successfully it will appear on LinkFerret's "Select capture device..." menu selection with the phrase "[LinkFerret-Capture]" contained within the description.
  17. Although in some cases it may not be necessary, we recommend that you reboot the system before using LinkFerret.


Installing LinkFerret's Wireless Driver on Windows 98

  1. Install the adapter per the manufacturer's instructions
  2. If the device is removable then make sure that it is inserted
  3. Invoke the Control Panel and select the "System" icon
  4. Select the "Device Manager" tab
  5. Open network adapters
  6. Select the [Cisco/Aironet or WaveLAN/Orinoco] wireless adapter
  7. Select "Properties"
  8. From the property sheet select "Driver"
  9. Select "Update driver"
  10. Follow directions provided, and specify "Search for a driver". Use the "Browse" button and navigate to:

    "Program Files\Baseband Technologies\Linkferret Network Monitor\drivers"

    The name of the .inf file describing the driver is either lfan4500.inf for the Cisco/Aironet adapter or lfprism.inf for the WaveLAN/Orinoco. Most likely the LinkFerret driver will not be specified as the recommended choice. If it is not, then check the "install one of the other drivers" checkbox and follow the instructions given.
  11. After the driver is installed successfully it will appear on LinkFerret's "Select capture device..." menu selection with the phrase "[LinkFerret-Capture]" contained within the description.
  12. Although in some cases it may not be necessary, we recommend that you reboot the system before using LinkFerret.


Installing LinkFerret's Wireless Driver on Windows NT

We don't support wireless monitoring on versions of Windows NT earlier than Windows 2000.