Is it possible to sniff or capture 802.11 packets which sends my computer to the router (AP). I know that I can't sniff packets which have a other destination MAC address without going into monitor mode, but is it possible to capture and see the 802.11 packets which are sent from my computer to the AP and received from the AP?
I want to use my default network adapter to do this (No monitor mode support). Is it possible?
No. You absolutely can see frames you generate or are destined for your radio without monitor mode. With the exception of the initial 802.1x handshake, unfortunately. You will need something like wireshark or tcpdump. However if you're talking about the 802.11 EAP you'll need a device you can use in monitor mode since they aren't passed through as standard frames: (might I suggest an ALFA AWUS036H)
They both rely on something called libpcap to allow you access to the layer2 messages your network devices see. Now this isn't perfect and the packets can get modified before you see them by your NIC. (eg. if you're capturing on a windows system, you'll likely see errors for TCP and IPv4 Checksum mismatches, that's due to a feature called TCP Offload Engine.) Monitor mode should get passed those limitations.
Unfortunately I'm not aware of any way to grab the pre-auth 802.1x packets without monitor mode. The first frame you'll see inside a pcap like this is likely the DHCP request frame.
What might work, is if you install a virtualization environment (VirtualBox or Vmware for instance) and then attempt to setup bridge mode on the interface and then use the virtual adapter to snoop the 802.1x frames. You will need to authenticate within your virtual machine but then you could presumably snoop it through the virtual interface.
I do not believe so. When the wireless card is in managed mode (the usual client mode) the card looks at the 802.11 header and passes everything else onto the kernel, so you are missing that header. In monitor mode, applications can more or less get the raw output from the wireless card, including the 802.11 header.
I think you could make your pc as a network proxy for your lan, so that all the traffic passes through it and wireshark can hopefully capture the packets. Hope it helps.
