Yes, I do know to capture wireless traffic you really need to enable monitor mode, so please don't steer the discussion that way. I am asking about the unusual behavior (at least to me) that has been observed when you do capture without monitor mode enabled.

This question came across on Serverfault where someone asked about missing 802.3 Ethernet headers when capturing wireless traffic in monitor mode with Wireshark. With my networking background, I knew there shouldn't be 802.3 headers in 802.11 traffic. But the user provided screenshots of both, so I got curious.

I tested this myself (Ubuntu 14.04LTS w/Intel Advanced-N 6200) and it appears to be true. When I capture without monitor mode enabled, instead of the expected 802.11 headers, I get 802.3 headers in the traffic. I haven't tested on other operating systems to see if it is true there or not, but I figured I would ask to see if someone had an explanation.

Can anyone explain why this is the case with Ubuntu?

Is the driver or wireless interface bridging this to 802.3 traffic before handing it off to the kernel for some reason? Or is something else going on?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.