I can't understand much about packet sniffing operation when it's in a network.
Well, packets are encrypted with PTK to prevent sniffing from monitor mode but when we are in client mode and we connected to a network, we were able to read those packets only using ARP spoofing and Wireshark. The thing that drives me nuts is that, are those packets supposed to be encrypted with PTK even when we connect to a network? How can we read those packets? Did we decrypt it somehow?
Establishing a connection to a WiFi network is similar to plugging in an Ethernet cable into a switch. Where Ethernet provides physical security due to a use of a non-shared cable, WiFi works in a medium shared with others and provides comparable security by using encryption. This way both WiFi and Ethernet offer a secure Physical layer.
Everything else is then on Data link layer (ARP) and above (IP, TCP, HTTP, ...). Without a working physical layer, i.e. without established connection to the WiFi network or plugging in the Ethernet cable, these layers above cannot work - which also means that no packets at these layers can be sniffed or spoofed. The details on which physical layer is used (i.e. WiFi vs. Ethernet vs. ...) and also any encryption and decryption inside the physical layer is (mostly) transparent to the upper layers.
