I know that you can sniff packets from other computer in network by mitm attack using arpspoof, but why to bother if you can turn on monitor mode and sniff all trafic(if I understand correctly monitor mode lets you sniff all packets). Of course I have key to the network so I can decipher it.
2 Answers
You're correct, but only for wireless clients. If you want to trick wired clients into routing their packets to you instead of the real router, you'd want to arpspoof. This way allows you to capture both wired and wireless client's data.
-
-
Thank you very much. What about promiscuous mode? Is it the same as monitor mode but for ethernet? Aug 28, 2018 at 11:34
-
@Adrian Rudy Dacka, this link should help answer your question. security.stackexchange.com/questions/36997/…– xoristAug 28, 2018 at 11:42
Because monitor only allows you listen you in. You need arpspoof to invoke a response from a server or interfere with an existing communication channel
