Packet injection in a Wi-Fi network

Question

I have read some articles describing that one can use the monitor mode on a NIC to do packet injection.

I really don't understand why I cannot just use the managed mode to forge the packets, and I can use another computer be a sniffer to sniff the packets.

Recently I tried two experiments:

1. I tried to use Scapy to send the 802.11 probe response in managed mode. However, from the sniffer I cannot see the packets on the air.
2. If instead I send with the 802.11 QoS packet, then the sniffer shows the packets.

What's the difference between these two cases? Is this because I don't use in monitor mode so I cannot send the probe response?

Answer 1

After doing some research on the internet:

I found some of the adapters can do TX when they are in monitor mode.

This is the reference, and from this reference I bought TP-LINK TL-WN722N.

http://www.wirelesshack.org/top-kali-linux-compatible-usb-adapters-dongles-2015.html

And from the github open source, I found a really interesting project. Here is the link:

https://github.com/rpp0/scapy-fakeap

This is a Python project, and it can be simulated as an AP.

Follows the instructions on the git-hub, I successfully launch this fakeAP in the monitor mode. And from sniffer, I can found the beacon frame are sent from this fakeAP. The blue rectangle is the beacon frames, and the red rectangle is the SSID I specified in the program.

The following is the sniffer:

I also try with Managed mode, but the program launch fail. Hope this post will help anyone who are interested in this field.