I am trying to get a deeper understanding about the inner working of WiFi Protected Setup and its active attack using reaver, bully and other utilities.
What I am really unable to realize is why it is necessary to set the network card on the bruteforcing device in monitor mode. Monitor mode allows to inspect traffic from any network no matter if you're associated to them or not, and to transmit packets in any network as well - that is, packet injection.
Why is packet injection required for WPS cracking, though? Since reaver do associate with the AP before starting to try PINs, to me it just looks it is behaving like any client trying to do the WPS pin exchange. Just, a quite insistent client :).
So, I can't realize why is monitor mode necessary for it. Thank you very much for any clarifications.