What is monitor mode used for?

Posted on 10th June 2025. I have seen this question asked many times on many forums and I have even asked myself the same question. But, somehow or the other we never get to the bottom of it.

Monitor mode is when a device sends data on a network that allows you to receive data. You are effectively a man-in-the-middle.

So, basically the question is - does someone always need to be on the same network as the target device? If you are using a laptop to send the data, then your own device will only be receiving it when you are on the same network as the device. If you are on the same network as the device but the device is not connected to your network (or you are on a different network) you will still get the data. The way the network works, you will probably have to be on the same network as the device before you can send the data to it. And if you do not need to send data to the device, you can simply disable the network on your laptop and use a USB stick to connect to the device. This is very similar to using port forwarding, however you are sending the data straight to the device, rather than the router. Here is a good example of how the Network works: A laptop is on the same network as the target device, but the target device is not connected to the same network as the laptop. The laptop can send data to the target device and the router will send the data from the laptop to the target device. The router will not forward the data to the target device. The laptop will not see the data from the target device.

Now, if the laptop moves to a new network, it will still be able to send the data to the device on the new network. However, the router will not send the data from the laptop to the target device on the new network.

If the target device moves to a new network, it will not be able to receive data from the laptop or the router. However, it will still be able to receive data from devices on the new network.

Now, what happens when the target device moves to a new network?

How to monitor traffic in Wireshark?

Wireshark is a powerful tool for monitoring network traffic, it comes with a built-in traffic graphing application called wireshark-lite.

Wireshark-lite is lightweight and uses less memory than Wireshark itself. By default, it stores captures in the file named wspcap20150612.200101. However, if you are using Windows, it is always possible to capture the packets by using Microsoft .NET Framework libraries instead of TCP/IP stack.

While using Wireshark, it is easy to monitor traffic on the network but the problem arises when the user has to work with multiple IP addresses and this proves to be quite a bit of cumbersome task. So, this tutorial will help you to easily monitor your network traffic in Wireshark by making use of wireshark-lite's capabilities in a seamless manner. For this, we will need two network adapters :

Network adapter 1: This is used for capturing packets from our PC over Ethernet/USB ports or Wi-Fi.e. Network adapter 2: This is used for monitoring traffic on the same Ethernet/USB ports/Wi-Fi network from which we capture packets. Step 1: Configure first network adapter (Ethernet/USB). If the network adapter is an Ethernet or USB adapter, it is always necessary to specify the DNS resolution in the IPV4 section in order to be able to obtain host IP address. While configuring an interface for capture on the PC that is running Wireshark we need to change IPV4 set (in case of an Ethernet adapter). To do this, select Edit > Preferences and configure it as shown in figure 1.

Figure 1 : Edit IPV4 preference window in Wireshark. Step 2: Use second network adapter (Wi-Fi). This is the network adapter which is required for monitoring traffic on the same Ethernet/USB ports or Wi-Fi network. To configure this interface, we should go to Edit > Preferences and add it to our IPV4 set. The IPV6 settings are also needed to be configured since Wireshark-lite is using this protocol as well. As shown in figure 2, here we configure just the IPV6 preferences.