Monitor mode or RFMON (Radio Frequency Monitor) mode, enables a device with a wireless network interface controller to monitor all traffic received from the wireless network. Unlike promiscuous mode, which is also used for packet sniffing, RFMON mode enables packets to be captured without having to connect or link with an access point. RFMON mode only works with wireless networks, while promiscuous mode can be applied to both wired and wireless networks.
RFMON mode is not really a wireless mode but it is especially important in attacking wireless networks. In a nutshell, it allows a wireless card to “monitor” the packets that are received without any filtering. Monitor mode is essentially the “promiscuous mode” equivalent for wireless. When using some wireless drivers, this mode allows for the sending of raw 802.11 frames. Airodump-ng, Aireplay-ng, and many other wireless tools require that the adapter be placed in monitor mode in order to operate.
The difference between promiscuous mode and Monitor mode:
-
The promiscuous mode works by sniffing the packets after associating with the access point. This is likely because the wireless devices send the packets in the air but only “mark” them to be processed by the proposed receiver.
-
The monitor mode works by sniffing the packets in the air without associating or linking with any access point.