Before we start wireless sniffing using Wireshark, it is helpful to understand the different operating modes supported by wireless cards. Most wireless users only use their wireless cards as a station to an AP. In managed mode, the wireless card and driver software rely on a local AP in managed mode to provide connectivity to the wireless network.

Another common mode for wireless cards is ad-hoc mode (or Independent Basic Service Set [IBSS] mode. Two wireless stations that want to communicate with each other directly can do so by sharing the responsibilities of an AP for a limited subset of wireless LAN services. Ad-hoc mode is used for short-term connectivity between stations, when an AP is not available to provide connectivity.

Many wireless cards also support master mode, where the wireless card provides the services of an AP when paired with the appropriate software. Managed mode allows you to configure your laptop or desktop system as an AP for providing connectivity to other wireless stations.

Finally, wireless cards support monitor mode functionality. When configured in monitor mode, the wireless card stops transmitting data and sniffs the currently configured channel, reporting the contents of any observed packets to the host operating system. This is the most useful mode of operation for analysis when using Wireshark, because a wireless card configured in monitor mode reports the entire contents of wireless packets, including header information and the encrypted...