Monitor mode is a valued feature for both the wireless penetration tester and security analyst. It allows the penetration tester to disconnect from a network and capture all frames in the network with full IEEE 802.11 headers and associated detail. By cycling through multiple channels supported on the wireless adapter, it is possible to capture detailed information for wireless network discovery and analysis purposes. On Windows, this was previously limited to commercial drivers. vistarfmon uses Vista’s Wireless LAN API (wlanapi) to help the penetration tester leverage all the power of monitor mode.You can read more about vistarfmon in Josh Wright’s “Vista Wireless Power Tools for the Penetration Tester” paper.