Monitor mode vs. Managed mode

jpm11 · Post by **jpm11** » Wed Feb 25, 2009 2:45 pm

So I got a question.

I just received my new Alfa 500mw USB wifi card, and it absolutely rocks.

In monitor mode (via kismet) it's showing around 50-60 APs. In managed mode (when connected to my AP) its showing like 5-10 APs.

This is the case on OSX (leopard) and Linux (bt4, ubuntu)

I know that in monitor mode, the card basically looks at "everything in the air" but what about in managed mode? Why such a big difference in AP count?

If I see some AP in monitor mode, will I be able to connect to it in managed mode?

Thanks alot.

Thor · Post by **Thor** » Wed Feb 25, 2009 8:10 pm

I don't remember all the technical details of the exact difference between monitor and managed mode, but I have been playing with this a little recently and I think the differenece is that in managed your looking at packets associated with a certain access point usually, Or, I believe, some packets coming directly to you for you.

You should be able to connect to an access point in managed mode, given you have provided the right credentials. I think alot of cards boot up in managed/client mode anyways. My atheros card has to be set to monitor for that to work. But I can connect as usual to near by access points.

jpm11 · Post by **jpm11** » Thu Feb 26, 2009 7:05 pm

Right, but that doesn't explain why monitor mode yields more AP's than managed modes.
I'm not even connected to any of them, just viewing them.

Thor · Post by **Thor** » Fri Feb 27, 2009 5:41 pm

Well it's possible your seeing AP's in monitor mode who have their BSSID's masked that you wouldn't be able to see in managed. I think it has to do with packets types you view though in each of the two modes. Sorry for lack of more detailed info on this. If you find out precisely why, please post what you found.

jpm11 · Post by **jpm11** » Sat Feb 28, 2009 10:26 pm

Thor wrote:Well it's possible your seeing AP's in monitor mode who have their BSSID's masked that you wouldn't be able to see in managed. I think it has to do with packets types you view though in each of the two modes. Sorry for lack of more detailed info on this. If you find out precisely why, please post what you found.

Sorry for off-topic, but you're really in Jamaica now? Lucky you dude.

spectre · Post by **spectre** » Thu Mar 26, 2009 8:16 pm

in monitor mode airodump will show ANY access point it even gets one beacon packet from, in managed mode it will often filter the APs to realistically connectable ones. also i believe that if you are using airmon-ng to put the alfa card into monitor mode then it will also run iwconfig wlan0 txpower 27 (501mW)

Monitor mode vs. Managed mode

Monitor mode vs. Managed mode

Re: Monitor mode vs. Managed mode

Re: Monitor mode vs. Managed mode

Re: Monitor mode vs. Managed mode

Re: Monitor mode vs. Managed mode

Re: Monitor mode vs. Managed mode