What capture mode is typically required to inspect 802.11 frames in Wireshark?

• A. Promiscuous mode on Ethernet
• B. Monitor mode on a compatible wireless interface
• C. Spoofing mode
• D. Block mode

Answer: (B)

Capturing 802.11 frames requires putting the wireless adapter into monitor mode. When a wireless card is in monitor mode, it stops associating with any particular network and instead captures every frame transmitted on the channel, including management and control frames as well as data frames. This raw view lets Wireshark show the full 802.11 header information, radiotap or similar metadata (like channel and signal strength), and frames such as beacons, probe requests/responses, authentication, and deauthentication frames. Promiscuous mode on an Ethernet interface isn’t sufficient because it deals with wired Ethernet frames and doesn’t provide the complete 802.11 air-frame data needed for proper analysis. The other modes mentioned aren’t standard capture modes for inspecting 802.11 traffic, so they don’t offer the full visibility required.