I was able to sniff the EAP packets from the attacker machine with a wireless card on p-mode, however i was not able to sniff this data off the user using the same card under windows. Wireshark, did not detect the card because it is external/USB. Microsoft network monitor in p-mode only shows the probe request and response, however i don't see the handshake between the attacker and the AP. does the Reaver attack hide its foot print so it can not be detected by sniffers ? i don't think so, if a packet is going to live air, it should be detected with a sniffer, right? is there specific things to account for?
Windows does not allow creating RAW data packets. This is why nmap has so many issues with running on windows. Articles are all over the internet saying if your wanting to analyze traffic use a linux environment. Nice tool is kali linux @ http://kali.org free tools such as wireshark come prepackaged