I can't understand much about packet sniffing operation when it's in a network.
Well, packets are encrypted with PTK to prevent sniffing from monitor mode but when we are in client mode and we connected to a network, we were able to read those packets only using ARP spoofing and Wireshark. The thing that drives me nuts is that, are those packets supposed to be encrypted with PTK even when we connect to a network? How can we read those packets? Did we decrypt it somehow?