image.png

查閱資料后發(fā)現(xiàn)，當無線網(wǎng)卡不支持或者沒有設(shè)置為monitor mode時，無線網(wǎng)卡的驅(qū)動會自動把802.11 frame 轉(zhuǎn)化為Ethernet frame后給kernel。官方解釋為：

If you‘re trying to capture network traffic that‘s not being sent to or from 
the machine running Wireshark or TShark, i.e. traffic between two or more 
other machines on an Ethernet segment, or are interested in 802.11 management 
or control packets, or are interested in radio-layer information about 
packets, you will probably have to capture in "monitor mode". This is 
discussed below.

Without any interaction, capturing on WLAN‘s may capture only user data 
packets with "fake" Ethernet headers. In this case, you won‘t see any 802.11 
management or control packets at all, and the 802.11 packet headers 
are"translated" by the network driver to "fake" Ethernet packet headers.

2017-11-27 16_45_50 _______________.png

此時無線網(wǎng)卡的模式為managed。因此，我試著去打開無線網(wǎng)卡的monitor mode。查閱資料后，使用命令：

sudo ifconfig wlan11 down
sudo iwconfig wlan11 mode monitor
sudo ifconfig wlan11 up

2017-11-27 16_45_28 _______________.png

2017-11-27 16_45_01 _______________.png

參考網(wǎng)址：
https://www.zhihu.com/question/30085207
http://blog.csdn.net/qq_28057541/article/details/52937742
http://www.lxway.com/425268056.htm