|
How does AiroPeek (ie. peek.sys) work?
To use AiroPeek (or AirSnort, Airodump, etc.) you must use a suitable driver + peek5.sys + peek.dll.
I would guess that peek5.sys is a protocol driver (or an NDIS5 intermediate driver) that binds to the wireless driver, and that peek.dll includes code that uses device IOCTL's to communicate with peek5.sys. This is how the pcap software on both linux and windows works.
But I don't see how this solves the problem. You still need a driver that encapsulates the entire dot11 frame - and for every frame, not just data - and passes it up. Almost all windows drivers don't do this. I would have thought that they would need to provide modified NDIS drivers in order to achieve this.
Obviously I'm wrong. Can someone point out what I'm missing.
Thanks,
Qwavel
|