PCAP Series #1 — Monitor mode on macOS, Linux, WLANPi
"The most common mistake in 802.11 capture is staying on channel 6 while the problem is happening on channel 36." ·
Session 1 of 5. In managed mode the driver filters everything except frames addressed to your device. Monitor mode (RFMON) puts the adapter in promiscuous receive — every frame the RF subsystem receives lands in Wireshark with a RadioTap header containing RSSI, MCS, channel, and PHY format.
macOS — Wireless Diagnostics
Window menu → Sniffer → select channel + width → Start
Creates a .pcapng in /var/tmp/. Your Mac stays associated — it uses a second virtual interface. Limitation: cannot capture 6 GHz on most Mac models.
Linux — iw
sudo iw wlan0 set monitor none
sudo ip link set wlan0 up
sudo iw dev wlan0 set channel 36 HT40+
Kill NetworkManager and wpa_supplicant first — they fight for the adapter. sudo airmon-ng check kill handles this.
WLANPi
WLANPi Go (Intel BE200) starts in monitor mode by default. Remote capture directly into Wireshark: ssh wlanpi@192.168.x.x "sudo tcpdump -i wlan0 -w -" | wireshark -k -i -
The channel selection mistake
Monitor mode captures only the channel your adapter is tuned to. Set the correct channel before capture. Check which channel the AP is on first. For 80 MHz, set both the primary channel and secondary offsets correctly. Next: Session 2 — Reading Beacon IEs.