RedditPP Mascot

RedditPP

r/wifi • … • u/KidSugoi

Why is Monitor Mode required to capture WiFi frames on a current connection?

Hi guys, new to the sub so let me know if this question is out of scope.

But can anyone explain to me exactly why a wireless interface can't sniff 802.11 frames without Monitor mode? From my understanding, Monitor mode is supposed to be for disabling the SSID filter that tells drivers to drop WiFi frames that aren't relevant to the device. But why can I not get the frames from a current connection? The frames do not even need to be promiscuous since I am only interested in the management frames between client and AP.

I have a few guesses as to why this is, but I can't find a definitive answer online.

1. When the device driver is in monitor mode and doesn't decode 802.11 headers to forward us the packet, it just never decodes it. The frames never get decoded for the ETH layer and none of the received data is actuated on the device. 2. The absence of the SSID filter increases traffic to a point where the device can't handle it. Even if the frames are decoded after being forwarded, there is no mechanism for filtering post-capture frames. So now the device would be spending time on wasted operations of decoding Frames not even meant for the device.

What is it about 802.11 headers that require devices to be Monitor mode to get? This question actually extends to Radio-layer information too, but I'm thinking that might be more of a driver feature and not norm.

​

— 0