I have read some articles describing that one can use the monitor mode on a NIC to do packet injection.

I really don't understand why I cannot just use the managed mode to forge the packets, and I can use another computer be a sniffer to sniff the packets.

Recently I tried two experiments:

  1. I tried to use Scapy to send the 802.11 probe response in managed mode. However, from the sniffer I cannot see the packets on the air.
  2. If instead I send with the 802.11 QoS packet, then the sniffer shows the packets.

What's the difference between these two cases? Is this because I don't use in monitor mode so I cannot send the probe response?

  • Can provide me some source to learn more about IEEE 802.11 packet forging? I was very interested in the stuff but couldnt find any source.
    – Sunny
    Nov 18, 2015 at 21:15
  • @Sunny, You can start with a Python module Scapy. This module can help you forge packets. There are lots of tutorial about this on the internet. If you are interested in cryptography, you can also have a look on aircrack. Aircrack is a linux tool and can help you forge packets to decrypt the keys for WiFi. Nov 18, 2015 at 23:46
  • Thanks Anakin, actually I want to try out the hole196 as there is no tool yet for that. If you are interested we can work together.
    – Sunny
    Nov 19, 2015 at 4:37
  • @Sunny Thanks for your invitation :), but I'm too busy with my current work. Hope you are doing well on that topic~~ Nov 20, 2015 at 12:30
  • I have to make 802.11 qos frames using scapy...plz suggest how to start and how to execute it..
    – user25569
    May 22, 2016 at 15:24

1 Answer 1


After doing some research on the internet:

I found some of the adapters can do TX when they are in monitor mode.

This is the reference, and from this reference I bought TP-LINK TL-WN722N.


And from the github open source, I found a really interesting project. Here is the link:


This is a Python project, and it can be simulated as an AP.

Follows the instructions on the git-hub, I successfully launch this fakeAP in the monitor mode. And from sniffer, I can found the beacon frame are sent from this fakeAP. The blue rectangle is the beacon frames, and the red rectangle is the SSID I specified in the program.

The following is the sniffer:

enter image description here

I also try with Managed mode, but the program launch fail. Hope this post will help anyone who are interested in this field.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.