NetStumbler.org Forums - View Single Post

richcorbs · 06-26-2002

Assuming that you have associated with the AP and can capture traffic using Ethereal, do the following two things:

1) Set the capture filter to "dst port 138" to minimize the traffic you capture.

2) During a capture set the display filter to "browser.command == 0x0c" (that's zero-x-zero-c). It will capture and display all the Domain/Workgroup announcements broadcast to the local subnet.

After/during the capture, Ethereal's "Info" field should have some text like this:

Domain/Workgroup Announcement WORKGROUP...

where "WORKGROUP" is the name of the domain or workgroup being announced. Getting the info you are after should be as simple as scrolling down through the list.

On my network these announcements happen every 15 minutes or so. I'd probably capture for 30 minutes or so to be sure I got everything.

Hope this helps.

Rich

-Long time registered user, first time poster.

06-26-2002	#3 (permalink)
richcorbs Registered Member Join Date: Apr 2002 Location: Utah Posts: 7	browser.command == 0x0c Assuming that you have associated with the AP and can capture traffic using Ethereal, do the following two things: 1) Set the capture filter to "dst port 138" to minimize the traffic you capture. 2) During a capture set the display filter to "browser.command == 0x0c" (that's zero-x-zero-c). It will capture and display all the Domain/Workgroup announcements broadcast to the local subnet. After/during the capture, Ethereal's "Info" field should have some text like this: Domain/Workgroup Announcement WORKGROUP... where "WORKGROUP" is the name of the domain or workgroup being announced. Getting the info you are after should be as simple as scrolling down through the list. On my network these announcements happen every 15 minutes or so. I'd probably capture for 30 minutes or so to be sure I got everything. Hope this helps. Rich -Long time registered user, first time poster. Last edited by richcorbs : 06-26-2002 at 01:52 PM.